spanishflorist[.]com

Analysis indicates the domain spanishflorist.com was registered on September 14, 2025 through SNAPNAMES 86, LLC. The authoritative name servers launch1.spaceship.net and launch2.spaceship.net resolve the domain to the IPv4 address 44.232.173.249, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. An HTTPS endpoint is present, secured by a Let’s Encrypt certificate issued under the R13 profile, and the server advertises Nginx with OpenResty and HTTP Strict Transport Security. An HTTP GET request returns status code 200 and the page title is reported as “For Sale Page”, suggesting the site is currently positioned for domain sale rather than active phishing content. VirusTotal scans show three of ninety‑five security vendors flagged the domain, and it is listed on two public blocklists, PhishDestroy and ScamSniffer.

The Gridinsoft trust score of zero further reflects a high‑confidence malicious classification. The domain is explicitly associated with a brand impersonation campaign targeting the brand “argent”. Current operational status is noted as offline, indicating the malicious infrastructure has been taken down or otherwise ceased serving content.

While the available telemetry confirms the infrastructure and intent, the exact malicious payload or credential‑harvesting mechanisms have not been observed, leaving the specific attack vector uncertain. Defenders should block the domain and its resolving IP at network perimeters, enforce TLS inspection to detect any future reuse of the certificate, and monitor for newly registered domains using the same registrar or name‑server pattern. Ongoing watchlist updates for the associated blocklists and continued VirusTotal re‑scans are advised to capture any re‑appearance of the domain or related infrastructure.