local309[.]com

This domain local309.com was created on May 10 2026 and registered through Launchpad.com Inc. Infrastructure analysis reveals that it resolves to IP address 172.67.171.153 located in CA under Cloudflare, Inc. with nameservers aarav.ns.cloudflare.com and harmony.ns.cloudflare.com. Mail exchange records are configured with priority ten for mx01.mail.icloud.com and an additional record starting mx0. The SSL certificate originates from Google Trust Services under the WE1 designation while the server returns an HTTP status code of 406. The domain maintains an active status with high risk classification tied to generic phishing.

Detection evidence shows the domain listed on one security blocklist and referenced in one AlienVault OTX threat intelligence pulse. VirusTotal reports indicate flags from two of ninety-five security vendors and the Gridinsoft trust score registers at zero out of one hundred. The domain is blocked by PhishDestroy. These indicators collectively support the confirmed malicious classification without reliance on any single source.

Uncertainties persist around the precise campaign targets or full mail infrastructure due to the truncated MX record and lack of additional branding details in the available data. Defenders should add both local309.com and 172.67.171.153 to internal blocklists and network monitoring rules. Review of traffic or messages involving the listed nameservers and mail exchangers is recommended along with periodic status checks to detect any infrastructure shifts while the domain remains active as of July 12 2026.