umsahju[.]bond

This domain, umsahju.bond, was registered on 16 September 2025 through Gname.com Pte. Ltd. The authoritative name servers resolve the domain to the IPv4 address 43.130.134.159. The hosting infrastructure has been observed by the PhishDestroy blocklist, which currently lists the domain as malicious. In addition, the domain appears on one external security blocklist, and VirusTotal records indicate that five out of ninety‑one scanning engines have flagged the domain as malicious. The limited detection footprint suggests a relatively new campaign that has not yet achieved wide exposure. The domain is classified as a generic phishing site, although no specific brand or credential‑capture page has been publicly disclosed.

No information is available regarding SSL certificate details, HTTP response codes, page title, or any associated threat‑intel feeds such as OTX or Safe Browsing. Consequently, the full scope of the phishing payload, targeted victims, and command‑and‑control behavior remain undetermined. Defenders should prioritize adding the IP address 43.130.134.159 to network‑level deny lists and ensure that any outbound connections to this address are blocked. Endpoint protection solutions should be updated to include the domain and its associated IP in URL filtering and reputation lists.

Because the domain is already present on at least one blocklist, intrusion detection and prevention systems configured to query external reputation services will likely flag traffic to umsahju.bond. Continuous monitoring of DNS queries for the domain and periodic re‑scanning with multi‑engine services are recommended to capture any escalation in detection rates. Organizations should also consider tightening email gateway policies to quarantine messages that contain links to the .bond TLD, given its recent abuse history. Until further forensic evidence becomes available, the domain should be treated as a high‑confidence phishing indicator.