269599[.]com

Analysis of the domain 269599.com indicates it was actively used for credential phishing before being taken offline on or before July 23, 2026. The domain was registered on October 17, 2024, through Name.com, Inc., and was hosted behind Cloudflare infrastructure, resolving to the IP address 104.21.70.212 within AS13335. Nameservers danica.ns.cloudflare.com and quentin.ns.cloudflare.com were in use, and the site employed a Google Trust Services SSL certificate (WE1). At the time of assessment, the domain returned an HTTP 403 status, suggesting access was restricted or the site was disabled.

The page title 'login' and the classification as credential phishing in threat intelligence sources align with typical credential harvesting tactics. The domain appeared on one security blocklist and was flagged by 13 of 95 security vendors in a VirusTotal scan. AlienVault OTX recorded the domain in 16 threat intelligence pulses, further supporting its malicious classification. Scamadviser assigned a trust score of 1 out of 100, reflecting high risk.

No specific brand or service was identified in the available data, so the exact target of the phishing attempt remains unconfirmed. Defenders should treat this domain as part of a credential theft operation and consider blocking it at the network level. The use of Cloudflare and an HTTP/3 deployment suggests efforts to evade detection and improve uptime, though the site is currently offline. Organizations should monitor for related infrastructure, particularly domains registered through the same registrar or using identical nameserver patterns, as these may indicate follow-up campaigns.