gaib[.]ac

The domain gaib.ac presents a minimal threat interface, displaying only a "Success!" page title. This lack of substantive content, combined with its recent registration, suggests it is designed for credential harvesting, phishing, or as a landing page for a broader malicious campaign. The page title is a common indicator of a fake confirmation page used to trick users into believing an action has been completed, often prior to redirecting to a malicious download or data capture form.

Technical analysis reveals 7 out of 95 VirusTotal vendors flagged the domain as malicious, including ADMINUSLabs, alphaMountain.ai, CyRadar, Fortinet, and Gridinsoft. It appears on one blocklist. The domain was created on November 9, 2025, and is hosted at IP address 172.67.206.23 located in the United States, using AS13335 Cloudflare, Inc. The registrar is Web Commerce Communications Limited. The SSL certificate is issued by Google Trust Services / WE1. Nameservers are anirban.ns.cloudflare.com and cass.ns.cloudflare.com.

The domain is currently down or offline, indicating it may have been taken down or is temporarily inactive. Given the high number of vendor detections, recent creation date, and lack of legitimate content, the risk level is assessed as high. Users who may have interacted with this site during its active period are advised to monitor for signs of compromise.