sz[.]tkzkky[.]net

The domain sz.tkzkky.net was registered on 13 June 2026 through IONOS SE and is hosted on the IONOS Cloud network (ASN 54548) in the United States, resolving to IP address 208.94.38.49. The authoritative name servers ns1.salhly.app and ns2.salhly.app are configured for the zone, and an MX record points to the same host with priority 0, indicating the domain is capable of receiving email. A TLS certificate issued by Let’s Encrypt (renewal year 1) is presented, and the web server returns HTTP 200 for the default request, with the page title “Document Viewing Error”.

VirusTotal analysis shows that 14 of 91 scanned security vendors flagged the domain, and it appears on a single public blocklist that is also referenced by PhishDestroy, which has taken the site offline. The infrastructure does not expose additional indicators such as overt login pages or downloadable payloads, and the limited visible content suggests the site may have been used to host malicious documents or to deliver a document‑viewing error page as a lure. Although the domain is currently offline, the short lifespan—registered less than two months before detection—combined with the use of a reputable certificate and a compromised‑looking host name aligns with known patterns for brand‑impersonation campaigns targeting Google users.

Defenders should add the IP address 208.94.38.49 and the domain name to block lists, monitor for any future DNS resolutions to the same host, and verify that any inbound messages referencing the MX record are quarantined. Email security gateways should be tuned to reject messages claiming to originate from Google but containing links to sz.tkzkky.net. Continuous observation of the IONOS Cloud AS and the salhly.app name servers may reveal repeat use of this infrastructure in subsequent campaigns.