action[.]pub

The domain action.pub is currently offline but exhibits multiple indicators of malicious infrastructure consistent with a generic phishing operation. Registration was performed through the AT‑88‑Z registrar, and the domain resolves to the IP address 52.72.49.79, which belongs to Amazon.com, Inc. (ASN 14618) and is geolocated in the United States. The authoritative name servers are ns1.systemdns.com, ns2.systemdns.com, and ns3.systemdns.com, a set frequently observed in other abuse cases. No SSL certificate is present, which aligns with the typical lack of encrypted transport for phishing sites that rely on rapid deployment. Threat intelligence sources reinforce the risk profile: AlienVault OTX lists the domain in sixteen separate pulses, indicating repeated observation across independent feeds.

The domain is actively blocked by the PhishDestroy sinkhole, and it appears on one public security blocklist. Reputation services assign extremely low scores—Gridinsoft rates it 0 / 100 and Scamadviser 1 / 100—reflecting a near‑certain malicious intent. VirusTotal analysis shows sixteen of ninety‑five scanning engines flag the domain, providing additional independent confirmation of compromise. Because the site is offline, direct content analysis is unavailable, leaving the exact phishing lure or targeted brand unspecified.

Nevertheless, the convergence of registrar, hosting, name‑server, and detection data constitutes strong evidence that the domain was used for phishing. Defenders should continue to block the IP address 52.72.49.79 at network perimeters, ensure that internal DNS resolvers refuse queries for action.pub, and monitor for any re‑registration attempts. Security teams should also propagate the observed indicators—ASN 14618, the three systemdns.com name servers, and the low trust scores—into threat‑intel platforms to improve detection of related infrastructure.