sigma[.]co[.]com

Analysis indicates that sigma.co.com is an offline domain currently hosting infrastructure that points to the Cloudflare edge network (172.67.164.212, AS13335, United States). The domain is delegated to four nic.co.com name servers, a configuration typical of legitimate domains but also used by abuse operators to leverage Cloudflare’s CDN and DDoS protection. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS handshake despite the site being unavailable (HTTP 503). The web stack identified includes CS Cart, PHP, and front‑end libraries such as OWL Carousel, Moment.js, jQuery, together with HSTS and cdnjs, indicating a typical e‑commerce platform possibly repurposed for malicious use.

The page title “Sigma | Phone Accessories | Power Banks | Batteries” suggests the site claims to sell electronic accessories, yet the domain is categorized as brand impersonation targeting Apple. VirusTotal scans show three of ninety‑five scanners flag the domain, and four independent blocklists (PhishDestroy, Polkadot, Enkrypt, Codeesura) have already listed it, reinforcing the elevated risk rating. MX records point to Google’s mail infrastructure, which does not mitigate the observed abuse. The domain was registered on 16 August 1997 through Moniker Online Services LLC, a long‑standing registrar, making historical ownership less indicative of current intent.

Defenders should continue to block the hostname and its associated IP ranges, monitor DNS queries for the four nic.co.com name servers, and enforce domain‑ and URL‑filtering policies that recognize the brand‑impersonation indicator for Apple. Because the site is offline, active content analysis is not possible; however, the existing infrastructure signals that the operator retains control of the Cloudflare‑protected host and may reactivate the site or repurpose the domain for future campaigns.