0efc87c2a1aaaf03e72d6f971113a2a1[.]info

The domain 0efc87c2a1aaaf03e72d6f971113a2a1.info was observed on July 24, 2026 and classified as a generic phishing threat. The site returned a page title of “403 Forbidden” and an HTTP status of 502, indicating that the service was unavailable at the time of measurement. DNS resolution pointed to the address 169.40.135.224, which is registered to Kraken Network ISP LTD in Germany under ASN AS209274. The domain is registered through NiceNIC International Group Co., Limited and was created on March 06, 2026.

Nameserver delegation uses ns1.erans.ru and ns2.erans.ru, and an MX record with priority 10 points to mail.0efc87c2a1aaaf03e72d6f971113a2a1.info, suggesting potential email usage for credential harvesting. The presented SSL certificate lists “Default Company Ltd” as the subject, a common placeholder that offers little confidence in the site’s identity. Threat intelligence shows the domain appears on one security blocklist and has been flagged by three of ninety‑four vendors on VirusTotal, reinforcing the suspicion of malicious intent. PhishDestroy has already blocked the domain, confirming that defensive feeds consider it hostile.

While the exact phishing payload or targeted brand is not disclosed, the combination of a recent registration, default certificate, and rapid detection across multiple sources suggests a short‑lived malicious campaign. Defenders should continue to block the domain and the associated IP, monitor the registrar and nameserver infrastructure for similar registrations, and consider adding the IP to network‑wide deny lists. Additional scrutiny of email traffic to the listed MX host may reveal attempted credential collection. Because the site is currently offline, further content analysis is not possible, and investigators should treat any future re‑activation as a high‑priority event for immediate containment.