app[.]aspecta-ai[.]com

The domain app.aspecta-ai.com was registered on 21 February 2026 through Tucows Domains Inc. It is hosted behind Cloudflare’s network (AS13335) and resolves to the IPv4 address 104.21.33.196, which is associated with Cloudflare’s US edge nodes. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, confirming that transport encryption is in place but not attesting to the legitimacy of the underlying service. The only page title observed is “Security Check – app.aspecta‑ai.com”, a phrasing commonly used by credential‑harvesting pages that force users through a verification step. The site employs HTTP/3, indicating a recent configuration.

It appears on a single public blocklist, PhishDestroy, and is listed as offline at the time of analysis. VirusTotal reports that one of ninety‑three scanned scanners raised a detection, providing an additional indicator of malicious intent. The combination of recent domain creation, use of a reputable CDN, minimal blocklist footprint, and a page title that suggests a security gate aligns with known phishing infrastructure patterns.

Nonetheless, the limited vendor detections and current offline status introduce uncertainty about active exploitation. Defenders should continue to block the domain at the network perimeter, monitor DNS queries to the 104.21.33.196 address, and incorporate the domain into URL filtering policies. Further investigation of the specific vendor that flagged the site and any associated payloads would clarify the threat’s severity.