buyahref[.]com

The domain buyahref.com was registered on August 03, 2024 through NameCheap, Inc. and currently resolves to the IP address 74.208.99.161, which is hosted in the United States under ASN AS8560 (IONOS SE). The web server identifies as Apache HTTP Server and presents a valid Let’s Encrypt (R13) TLS certificate. The site delivers an HTTP 200 response and includes Google AdSense technology, indicating that it is actively serving content. The page title observed, "Ahrefs Group Buy: Unlimited Ahrefs At 5$ » Buy Ahrefs," suggests a counterfeit offer designed to lure users seeking discounted access to a known analytics service.

Infrastructure analysis shows the domain is classified as a generic phishing campaign with a high risk rating. The Gridinsoft trust score is 0 out of 100, confirming a lack of credibility, and the domain appears on one security blocklist. It has been flagged by PhishDestroy, and VirusTotal reports that 2 of 95 security vendors have identified the domain as malicious, reinforcing the suspicion of hostile intent. Despite these indicators, the specific phishing kit or payload employed by the site has not been publicly disclosed, and no detailed content analysis is available beyond the page title.

Defenders should treat buyahref.com as an active threat. Immediate actions include adding the domain and its resolved IP address (74.208.99.161) to network and endpoint blocklists, enforcing URL filtering policies to prevent outbound connections, and monitoring DNS logs for any resolution attempts. Given the presence of a valid TLS certificate, deep packet inspection may be required to uncover malicious payloads hidden within encrypted traffic.

Continued surveillance is recommended to track any changes in the domain’s hosting, certificate renewal, or associated infrastructure. Organizations should also share indicators of compromise with relevant threat‑sharing communities to improve collective defenses against this and related generic phishing campaigns.