angrydynomiteslab[.]appsw[.]com

The domain angrydynomiteslab.appsw.com was registered on February 21, 2026 through Gabia, Inc. and is currently taken offline. DNS resolution points to the IP address 185.53.177.52, which is announced by AS61969 Team Internet AG and geolocated in Germany. The domain uses the public nameservers ns1.afternic.com and ns2.afternic.com, a configuration commonly observed in malicious infrastructure. The TLS certificate associated with the host is identified as R12, but no further details about validity or issuance are available.

The page title reported by passive monitoring is "appsw.com", offering no indication of the intended target or content. A single security blocklist, PhishDestroy, has listed the domain, confirming that it was recognized as a phishing vector. Gridinsoft assigns the domain a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal scanned the site with 95 antivirus engines and reported no detections; however, the absence of detections does not constitute evidence of safety.

The combination of a newly created domain, low‑reputation trust score, association with a known blocklist, and hosting on a German IP address managed by Team Internet AG suggests an opportunistic phishing campaign rather than a sophisticated, long‑standing operation. Uncertainties remain regarding the exact phishing lure, the credential‑stealing kit employed, and any victim interaction data, as no page content has been captured. Defenders should continue to block the domain at the network perimeter, monitor DNS queries for the associated IP and nameserver pair, and consider adding the domain to internal blacklists. Ongoing observation of related domains registered by the same registrar or using the same nameservers may reveal additional campaign activity.