paybill[.]uhuhyeereuii[.]com

Analysis of the domain paybill.uhuhyeereuii.com, observed as a brand‑impersonation vector targeting Telstra, indicates that the site was registered on 28 December 2025 through Cloudflare, Inc. and is currently taken offline. The domain resolves to the IPv6 address 2600:9000:229f:f400:17:876d:b540:93a1, which is hosted within Amazon’s AS16509 network in the United States. The authoritative name servers are guss.ns.cloudflare.com and marjory.ns.cloudflare.com, both Cloudflare‑managed, confirming the registrar’s continued control of the DNS infrastructure. Public threat intelligence shows the domain appears on a single security blocklist and has been actively blocked by PhishDestroy.

VirusTotal scans returned 15 positive detections out of 93 vendor engines, reinforcing the malicious assessment. The Gridinsoft trust score is 0 / 100, indicating a lack of reputation. No TLS certificate was observed, meaning the site would have served content over plain HTTP if it had been reachable. The only harvested page element is the HTML title “Privacy at Telstra – Privacy Statement – Telstra,” which aligns with the declared scam type of brand impersonation.

Given the limited exposure—offline status and a single blocklist entry—there is no evidence of large‑scale distribution or credential‑harvesting infrastructure beyond the domain itself. However, the presence of multiple detection votes and a zero trust score suggests that the domain was actively used for fraudulent purposes before takedown. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence of the same host name or IP address, and incorporate the IPv6 address and Cloudflare name‑server pair into threat‑intel feeds. Additional monitoring of related sub‑domains or newly registered domains using similar naming patterns is advisable, as attackers often recycle infrastructure after takedown.