d0wnla0dy0urd0c[.]help

The domain d0wnla0dy0urd0c.help was registered on November 18, 2025 through Porkbun LLC and is currently listed as offline. DNS resolution points to the IP address 108.177.126.100, which belongs to the AS15169 Google LLC network and is geolocated in the Netherlands. The domain is served by the authoritative nameservers ns7.privatedns.vip and ns8.privatedns.vip. No TLS certificate was observed, indicating that the site operated without HTTPS. The page title returned by the HTTP response was "Share Point Online," suggesting an attempt to impersonate a Microsoft SharePoint service, although the actual content has not been captured.

Multiple security controls have flagged the domain. Google Safe Browsing classifies it as a social engineering threat, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. AlienVault Open Threat Exchange reports the domain in sixteen distinct threat‑intel pulses, reinforcing its association with malicious activity.

VirusTotal analysis shows that sixteen of ninety‑five scanned security vendors flagged the domain, providing further corroboration of its hostile nature. Given the observed infrastructure, the lack of encryption, and the consistent detection across independent sources, defenders should treat d0wnla0dy0urd0c.help as a high‑risk phishing infrastructure. Recommended mitigations include adding the domain to network and email blocklists, monitoring DNS queries for the associated IP and nameservers, and ensuring that any traffic to the domain is denied at perimeter defenses. Continuous re‑evaluation is advised, as the offline status may change and additional indicators could emerge from future scans.