redbagproductions[.]com

Analysis of redbagproductions.com shows a high‑risk brand‑impersonation infrastructure supporting a crypto‑scam campaign. The domain was registered on 2026‑03‑11 through Ultahost, Inc. and resolves to IP 192.142.10.5, an address located in the Netherlands and associated with AS214036 Ultahost. All four authoritative nameservers (ns1‑ns4.ultahost.com) are hosted by the same provider, indicating a single‑owner deployment. The site returns HTTP 200 over LiteSpeed with PHP and HTTP/3 enabled, and serves a valid Let’s Encrypt R12 certificate, which does not mitigate the malicious intent. The page title advertises “Premium Membership Sites, eBooks & Digital Software Products,” a typical lure for cryptocurrency‑related fraud. Threat intelligence flags include presence on one public blocklist, detection in 24 AlienVault OTX pulses, and active blocking by PhishDestroy. VirusTotal reports 6 of 94 scanners flagging the domain, reinforcing the malicious classification. MX records point back to the domain itself, a common technique to control outbound email. The Gridinsoft trust score of 0/100 further confirms a lack of legitimacy. While the exact phishing or payment flow has not been observed, the convergence of registrar, hosting, detection history, and scam type strongly suggests ongoing fraudulent activity. Defenders should block the domain at network and DNS layers, monitor outbound connections to 192.142.10.5, and add the domain to internal allow‑list exclusions for legitimate services. Continuous monitoring of associated IPs and the Ultahost nameserver set is recommended, as further malicious sites are likely to be provisioned using the same infrastructure.