info[.]comabooks[.]org

The domain info.comabooks.org is currently listed as an active generic phishing site. The page title "Comabooks. Стань автором своей книги." suggests an attempt to masquerade as a legitimate publishing or self‑authoring service, leveraging the Comabooks brand name to lure victims. The site was registered on February 23, 2024 through Squarespace Domains LLC and is hosted on a DigitalOcean server (AS14061) located in Germany, resolving to IP address 64.226.113.11. The host is configured with four nsone.net name servers (dns1.p09.nsone.net through dns4.p09.nsone.net) and serves HTTPS using a Let's Encrypt certificate (E8). An HTTP request returns a 200 status code, indicating that the content is publicly reachable.

Infrastructure analysis shows that the domain is already flagged on one security blocklist and has been added to the PhishDestroy blocklist. VirusTotal scans report that 2 of 95 security vendors have flagged the domain, reinforcing the suspicion of malicious intent. The presence of a legitimate TLS certificate does not mitigate the risk, as it is commonly used by threat actors to lend credibility to fraudulent pages. The site’s content has not been publicly disclosed, so the exact credential‑stealing mechanisms remain uncertain.

Defenders should treat any traffic to info.comabooks.org as malicious. Network controls ought to block DNS resolution and HTTP/HTTPS connections to the domain and its underlying IP address. Email gateways should be tuned to detect messages that reference the Comabooks brand or contain URLs matching the domain pattern. Continuous monitoring of the associated IP range and name servers is advised, as the attacker may pivot to additional domains hosted on the same infrastructure. Incident response teams should also query internal logs for any prior connections to this host to assess potential compromise.