784890a6865f[.]net

Analysis of the domain 784890a6865f.net indicates it was associated with phishing infrastructure targeting SMS-related services. The domain was registered on February 24, 2026, through NiceNIC International Group Co., Limited, and resolved to the IP address 108.61.167.229, hosted on AS20473 (The Constant Company, LLC) in the Netherlands. No SSL certificate was detected, increasing the likelihood of unencrypted credential harvesting or data interception. The domain's nameservers, ns3.my-ndns.com and ns4.my-ndns.com, are consistent with bulletproof or low-reputation DNS providers often leveraged by threat actors.

The page title, 'SMS Panel,' suggests the site may have been designed to mimic or facilitate fraudulent SMS services, such as bulk messaging, credential interception, or phishing via text-based lures. As of the report date, the domain is offline, though it was previously flagged by four of 93 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy. Gridinsoft assigned a trust score of 0/100, further indicating malicious intent. Detected technologies include Ubuntu and Apache HTTP Server, which are common in both legitimate and malicious hosting environments.

Defenders should treat this domain as part of a broader phishing campaign targeting SMS or telecommunications services. While the exact payload or victimology remains unconfirmed due to the domain's offline status, the infrastructure aligns with known phishing patterns. Network defenders are advised to block the domain and its associated IP (108.61.167.229) at the perimeter, monitor for related DNS queries, and investigate logs for prior connections. Given the domain's registration through a low-reputation registrar and its presence on blocklists, organizations should prioritize retrospective analysis of any interactions with this infrastructure.