ponz[.]family

On 2026-08-07 SOC analysts reviewed the newly observed domain ponz.family. The WHOIS record shows the domain was registered through NameSilo, LLC and its creation timestamp is 2026-07-16, indicating a recent launch. DNS resolution points to the IPv4 address 45.9.148.108; no additional A or CNAME records were observed. The domain is currently listed on two public blocklists, specifically PhishDestroy and ScamSniffer, and both services have flagged it as malicious. VirusTotal reports that the domain has been scanned by 91 antivirus and URL-reputation engines; none of the engines raised a detection at the time of analysis.

The absence of detections does not constitute a safety guarantee, as many scanners rely on signatures that may not yet cover this campaign. No TLS certificate data, HTTP response codes, or page-title information have been published, and automated crawlers have not returned a content fingerprint. Consequently, the specific brand or service being impersonated remains unknown, and the exact phishing vector cannot be confirmed. The limited evidence suggests the infrastructure is being used for a generic phishing operation, but the lack of payload samples leaves the precise tactics, techniques, and procedures (TTPs) unverified.

Defenders should treat ponz.family as a high-confidence indicator of compromise. Immediate mitigation steps include adding the domain and its resolving IP 45.9.148.108 to network deny lists, updating DNS filtering policies to block resolution, and ensuring that email gateways enforce URL-reputation checks that incorporate the PhishDestroy and ScamSniffer feeds. Continuous monitoring for any new hostnames, changes in SSL configuration, or appearance of the domain in sandboxed traffic is advised. If future analysis yields page content or credential-stealing forms, the findings should be correlated with existing phishing kits to refine detection rules.