find-device-alert[.]click

Analysis of find-device-alert.click shows a newly registered domain (created 23 Mar 2026) that is currently offline. The site served an HTTP 523 response and its page title returned “Access Denied”. Infrastructure data indicates the domain resolves to IP 50.6.199.153, an address assigned to Oracle Corporation in the United States. The host runs Apache HTTP Server and presents a Let’s Encrypt certificate issued under the E7 profile.

Nameserver records point to dns1.dnspremium.pro and dns2.dnspremium.pro, and the registrar is listed as Sav.com, LLC. Threat‑intel feeds flag the domain as a credential‑phishing operation; 17 of 94 VirusTotal scanners have raised alerts, Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the host. The low trust score, multiple vendor detections, and the “Access Denied” title are consistent with a takedown or a defensive response, but the offline status does not preclude future reuse of the same infrastructure.

Uncertainty remains regarding the exact phishing campaign payload, target audience, and whether the domain was ever actively serving malicious content before being taken down. Defenders should continue to enforce DNS and URL filtering for the domain and its associated IP address, monitor for re‑registration or similar naming patterns, and consider adding the IP to network‑level blocklists. Ongoing observation of the hosting provider and the dnspremium.pro name servers is advised, as they have been used in other malicious deployments.