alliancelimousinedenver[.]com

The domain alliancelimousinedenver.com is currently active and has been classified as a generic phishing site targeting users of Alliance Limousine. The site returns an HTTP 302 redirect and presents a valid Let's Encrypt certificate (R13), indicating that the infrastructure is capable of obtaining publicly trusted TLS. Infrastructure analysis shows the domain is hosted on IP 198.251.84.200, which resolves to a server located in Luxembourg and operated by FranTech Solutions. Authoritative DNS is provided by ns5.my-control-panel.com and ns6.my-control-panel.com, both associated with the registrar Webcentral Group Ltd. The web stack identified includes WordPress, MySQL, PHP, Yoast SEO, All in One SEO, LiteSpeed, jQuery, and HTTP/3 support. The domain was originally registered on 11 March 2004 and appears on a single security blocklist, PhishDestroy, which has already blocked it. VirusTotal scans have flagged the domain by 4 of 95 security vendors, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. These signals collectively confirm the domain’s hostile intent despite its long registration age. Defenders should block traffic to 198.251.84.200 and to the domain alliancelimousinedenver.com at the DNS layer, enforce TLS inspection to capture the redirect, and monitor for any credential harvesting attempts that reference Alliance Limousine. Continuous re‑evaluation is advised, as the site remains active and may evolve its payload or hosting.