notebookoff[.]uz

This domain, www.notebookoff.uz, is currently flagged as an active phishing site targeting users in the Uzbek market under the guise of selling laptops in Tashkent. Analysis indicates the site presents itself as a legitimate electronics retailer, with the page title 'Ноутбуки в Ташкенте - Купить с доставкой по Ташкенту' suggesting localized delivery services. The domain was registered on May 21, 2020, and remains operational as of July 12, 2026, resolving to IP address 167.235.222.200, which is hosted on AS24940 (Hetzner Online GmbH) in Germany. A 301 HTTP redirect is present, which may be used to obscure the final destination or chain multiple compromised domains together in the attack flow. Infrastructure review reveals the domain uses Let's Encrypt SSL certificates (R12) and is served via nameservers dns1.webspace.uz and dns2.webspace.uz, both pointing to 95.46.96.77. While the domain appears on one security blocklist and is flagged by a single vendor on VirusTotal, these detections are not conclusive on their own. However, the Gridinsoft trust score of 0/100 further supports the assessment of malicious intent, particularly in the context of credential harvesting or payment fraud. The longevity of the domain—active for over six years—may contribute to its perceived legitimacy among unsuspecting users. Defenders should treat this domain as high-risk due to its persistent operation, localized social engineering tactics, and hosting on infrastructure commonly associated with phishing campaigns. Network-level blocking is recommended for the domain and its associated IP address. Organizations should monitor for any redirects or subdomains linked to this infrastructure, as attackers may leverage the established reputation to bypass initial filters. No evidence currently links this domain to a specific phishing kit or threat actor, but the consistent use of Hetzner hosting suggests a preference for bulletproof or low-cost hosting providers.