remote[.]spacepe[.]in

The domain remote.spacepe.in was registered through GoDaddy.com, LLC on August 04, 2023 and is currently listed as taken offline. DNS resolution points to the IPv4 address 49.207.40.162, which belongs to ASN18209 (Atria Convergence Technologies Ltd.) and is geolocated in India. The authoritative name servers are ns-1491.awsdns-58.org, ns-165.awsdns-20.com, ns-1838.awsdns-37.co.uk, and ns-735.awsdns, indicating use of Amazon Route 53 for DNS hosting. An SSL certificate issued by Let’s Encrypt (certificate identifier E8) is present, providing valid HTTPS encryption but offering no indication of legitimacy.

The web server returns the page title "Apache Guacamole," a legitimate remote‑desktop gateway product, yet no further content analysis is available, leaving the actual payload or credential‑capture mechanisms unknown. Gridinsoft assigned a trust score of 0 / 100, reflecting a highly suspicious reputation. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal analysis shows that 2 of 95 scanning engines flagged the domain, confirming some detection of malicious activity.

No additional intelligence, such as specific phishing kits, targeted brands, or observed victim reports, is presently documented. Defenders should continue to block remote.spacepe.in at DNS and proxy layers, monitor outbound connections to 49.207.40.162 for anomalous patterns, and consider adding the IP to network‑level deny lists. TLS inspection can reveal any hidden payloads despite the valid certificate. Continuous re‑scanning of the domain and its IP is advised in case the site is re‑hosted, and any future detections should be correlated with this baseline evidence to accelerate incident response.