aspicorn[.]testdev[.]sbs

Analysis of aspicorn.testdev.sbs shows a newly registered domain (created 21 Feb 2026) hosted on IP 198.251.89.220, which belongs to AS53667 FranTech Solutions in the United States. The domain is registered through Dynadot LLC and uses the authoritative nameservers ns27.asurahosting.com and ns28.asurahosting.com. An HTTPS service is present with a Let’s Encrypt R13 certificate, and the web server identifies as LiteSpeed supporting HTTP/3. The only visible page content is the title “Index of /”, indicating a directory listing rather than a crafted landing page.

VirusTotal records show that 7 of 93 scanning engines flagged the domain, and it is listed on the PhishDestroy blocklist as well as one additional security blocklist. The current operational status is offline, and no further page content has been captured. The combination of a recent registration, use of free SSL, generic server stack, and multiple vendor detections aligns with typical infrastructure employed for generic phishing campaigns, although the exact target or credential‑stealing mechanism cannot be confirmed from the available data.

Defenders should treat the domain as malicious until proven otherwise: block the domain and its resolving IP at perimeter and endpoint filters, add the nameservers to watchlists for any future sub‑domains, and monitor for re‑registration or resurrection of the site. Continuous threat‑intel feeds should be consulted for any emergence of payload URLs or phishing kits associated with this infrastructure. Because the site is presently offline, active probing is not required, but periodic DNS resolution checks are advised to detect any re‑activation.