databservices[.]com[.]ng

On July 12, 2026, the domain databservices.com.ng was identified as a high‑risk phishing site. The page served a 200 HTTP response and presented the title "Databservices - Buy/Resell Cheap Data, VTU Airtime, and Pay Utility Bills," suggesting an attempt to masquerade as a legitimate data‑sale and utility‑payment service. The domain was created on December 13, 2023 and is currently active, indicating a sustained operation over multiple years.

Infrastructure analysis shows that the domain is registered through TRUEHOST CLOUD and resolves to the IPv4 address 51.161.196.101, which belongs to OVH Australia PTY LTD. The hosting location is Australia, and the site uses a Let's Encrypt R12 SSL certificate, providing encrypted transport but not authenticating the underlying service. The modest Gridinsoft trust score of 35 out of 100 further reflects a low reputation across scanning engines.

Threat intelligence sources corroborate the malicious classification. AlienVault OTX recorded the domain in one distinct pulse, and VirusTotal flagged the site with three detections out of ninety‑five security vendors, confirming that multiple scanners have observed suspicious behavior. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy mitigation service, indicating that defensive communities have begun to take action against it.

While the observed infrastructure and intelligence points clearly to a phishing operation, the exact payload, credential‑harvesting mechanisms, and any post‑delivery infrastructure remain unknown. Defenders should block the domain at the DNS and network perimeter, enforce TLS inspection to capture any credential submission, and monitor for related indicators such as the IP address 51.161.196.101 and the associated SSL certificate fingerprint. Continuous threat‑intel feeds should be consulted for any new detections or attribution that may emerge as the campaign evolves.