shadowdemon[.]privatedns[.]org

Analysis of shadowdemon.privatedns.org confirms its classification as a credential-theft phishing domain, currently offline but previously active. The domain was registered on February 21, 2026, through Tucows Domains Inc. and resolved to the IP address 77.110.103.90, hosted under AS210644 AEZA GROUP LLC in Germany. Infrastructure analysis reveals the use of nameservers ns1.afraid.org through ns4.afraid.org, a common pattern observed in low-cost or bulletproof hosting setups frequently exploited for phishing operations. The page title, 'Shadowdemon: Authtentication Page,' contains a typographical error ('Authtentication'), a tactic often employed to bypass basic security filters while maintaining the appearance of legitimacy. No SSL certificate was detected, increasing the likelihood of interception of unencrypted credentials.

The domain returned an HTTP 404 status at the time of assessment, indicating it has been taken offline or moved, though this does not preclude future reactivation under the same or altered infrastructure. Security vendor detections on VirusTotal indicate that 8 of 93 engines flagged the domain as malicious, a modest but notable signal given the variability in detection capabilities across vendors. The domain appears on at least one security blocklist, specifically PhishDestroy, and holds a Gridinsoft trust score of 0/100, reinforcing its classification as high-risk. No additional brand targets, phishing kits, or scam categories were specified in available intelligence, limiting further attribution beyond generic credential theft. Defenders should treat this domain as confirmed malicious and block it at DNS, proxy, and endpoint layers.

Historical resolution data should be reviewed to identify any prior connections from internal networks. Given the use of afraid.org nameservers and AEZA GROUP hosting, organizations may wish to monitor for related domains or IPs exhibiting similar infrastructure patterns.