asfimuqss[.]sbs

Analysis as of July 24, 2026 indicates that the domain asfimuqss.sbs is currently offline but was previously identified as a generic phishing site. The domain was registered on November 15, 2025 through Web Commerce Communications Limited and uses Cloudflare name servers (asa.ns.cloudflare.com, fattouche.ns.cloudflare.com). DNS resolution points to the IP address 104.21.7.183, which belongs to ASN 13335 operated by Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was presented when the site was reachable, leaving the connection unencrypted.

The page title observed during the brief availability period was “Toll Shop ASFINAG | official ASFINAG toll shop,” suggesting an attempt to impersonate the Austrian motorway operator ASFINAG. VirusTotal recorded eight detections out of ninety‑five scanned engines, and the domain appears on a single external blocklist, specifically PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious classification. The combination of a brand‑targeted title, lack of SSL, Cloudflare hosting, and multiple vendor detections aligns with typical phishing infrastructure.

Defenders should ensure the domain is blocked at network perimeter and DNS filtering solutions, monitor the IP address 104.21.7.183 for any re‑use in malicious campaigns, and add the domain hash to internal threat intel feeds. Continuous observation of Cloudflare‑hosted assets that resolve to the same ASN is advised, as threat actors frequently leverage such services to rotate malicious sites. Because the site is offline, immediate containment is limited to preventive controls; however, logging of any attempted connections to the domain or IP can provide early warning of ongoing targeting attempts.