aldakheelholding[.]com

This domain is assessed as elevated risk and has been associated with brand_impersonation activity targeting the IRS. Analysis indicates the infrastructure was configured to present content using the title "IRS - Internal Revenue Service," a characteristic commonly observed in impersonation campaigns intended to mislead users into trusting fraudulent communications, forms, or credential collection workflows. The domain is currently offline; however, historical indicators remain relevant for detection, investigation, and retrospective security review.

Technical intelligence shows that 21/95 security vendors flag this domain as malicious or suspicious. Registration records indicate the domain was registered through Cosmotown, Inc. and created on August 13, 2025. Infrastructure analysis identifies IP address 64.20.55.190 as the resolved host, located in the United States within AS19318 Interserver, Inc. The domain appears on 1 security blocklist and has been blocked by PhishDestroy. The observed impersonation target is the IRS, and the recorded page title was "IRS - Internal Revenue Service." No SSL certificate was identified for the domain. Current status indicates the site has been taken offline, reducing immediate exposure but not eliminating the value of the indicators for threat hunting and correlation.

Recommended mitigation actions focus on brand impersonation abuse. Users should avoid interacting with historical links associated with this domain and should independently verify any tax-related communications through trusted official channels rather than embedded links or redirected pages. Security teams should block the domain and IP address 64.20.55.190, review logs for prior connections, and investigate any instances where users may have accessed the impersonation page. Email, DNS, proxy, and endpoint telemetry should be searched for references to the domain. Given the 21/95 detection rate, the documented impersonation of the IRS, the presence on 1 security blocklist, and the absence of an SSL certificate, the indicators warrant continued monitoring despite the domain's offline status.