sales[.]highsierrapools[.]us

On 24 July 2026 analysts examined the domain sales.highsierrapools.us, which is currently taken offline. The site presented the page title “HSP‑SALES”. DNS resolution returned the IPv4 address 173.79.175.205, which belongs to AS701 Verizon Business and is geolocated in the United States. The domain is registered through IONOS SE and was created on 29 July 2010. Authoritative name servers are ns1107.ui-dns.biz, ns1107.ui-dns.com, ns1107.ui-dns.de, and ns1107.ui-dns.org. Mail exchange records list mx00.1and1.com and mx01.1and1.com, both with priority 10.

HTTP headers indicate the presence of Nginx and HTTP Strict Transport Security (HSTS). The TLS certificate is issued by Let’s Encrypt (R13) and matches the domain name. Reputation services flag the domain as malicious. Google Safe Browsing classifies it under social engineering, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy.

VirusTotal analysis shows that ten of ninety‑three scanners returned a malicious verdict, reinforcing the suspicion of abuse. The campaign has been labeled an investment scam, consistent with the “generic phishing” threat type assigned. Given the observed infrastructure and the multiple detection sources, defenders should add sales.highsierrapools.us to outbound and inbound block lists, monitor the associated IP 173.79.175.205 for any resurgence, and enforce strict URL filtering for the identified nameservers and MX hosts. Continuous re‑evaluation of the domain’s status is advised, as offline domains can be re‑activated by the threat actors. Organizations using similar branding should educate users about the “HSP‑SALES” indicator and reinforce reporting of unsolicited communications that reference this domain.