airlitedocsac[.]com

Analysis of the domain airlitedocsac.com indicates it was a phishing site targeting users through fraudulent document-themed lures. The domain was registered on March 11, 2025, via NiceNIC International Group Co., Limited, and resolved to IP address 172.67.156.38, hosted on Cloudflare's network (AS13335). The site employed Cloudflare nameservers (lilith.ns.cloudflare.com and zahir.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which are common among both legitimate and malicious infrastructure. The page title, 'Loved Before We Could Love,' suggests a social engineering approach, though the exact content or targeted brand remains unconfirmed as the site is currently offline.

Detection data reveals moderate but consistent flagging: 14 of 93 security vendors on VirusTotal classified the domain as malicious, and it appeared in five AlienVault OTX threat intelligence pulses. The domain was also blocked by PhishDestroy and listed on one additional security blocklist. The use of Mailjet, a legitimate email service provider, alongside Cloudflare and HTTP/3, aligns with tactics observed in phishing campaigns seeking to blend in with normal traffic.

While the domain is no longer resolving, defenders should treat it as a confirmed phishing artifact. Historical DNS and WHOIS records should be preserved for incident response, and any associated email addresses or certificates should be monitored for reuse in future campaigns. Given the elevated risk classification and detection counts, this domain warrants inclusion in threat intelligence feeds and blocking rulesets.