ww25[.]cajamar[.]ibercaja-connexion[.]online

The domain ww25.cajamar.ibercaja-connexion.online was created on February 07, 2025 and registered through Domain Science Kutatasi Szolgaltato. Its authoritative nameservers are 5579.ns1.abovedomains.com and 5579.ns2.abovedomains.com. DNS resolution points to IP address 199.59.243.228, which is hosted in the United States and belongs to ASN 16509 operated by Amazon.com, Inc. No TLS certificate was observed for the host, indicating that any service was delivered over plain HTTP. The site is presently marked as offline, but historical evidence shows it was employed in a brand‑impersonation campaign that targeted GoDaddy.

The page title returned by the server was "ibercaja-connexion.online" and the campaign has been linked to the publicly known Airdrop Scam phishing kit. VirusTotal analysis recorded three detections out of ninety‑five scanners, and the Gridinsoft trust score assigned the domain a value of zero out of one hundred, reflecting a high confidence of malicious intent. The domain is listed on one security blocklist and has been actively blocked by the PhishDestroy mitigation service.

Because the site is no longer reachable, the exact content, credential‑capture mechanisms, and any additional payloads remain unverified. Defenders should proactively block the domain name and its resolving IP at network perimeters, incorporate the domain and its associated nameserver pattern into DNS‑based blocklists, and monitor for any re‑registration or the appearance of similarly structured subdomains using the same registrar. Continuous sharing of these indicators with threat‑intel platforms will aid in early detection of related campaigns.