vdhdndimsmx[.]imi[.]lat

Analysis of the domain vdhdndimsmx.imi.lat indicates it was serving a generic phishing kit hosted on infrastructure associated with ALC Hosting Networks. The domain, registered on January 17, 2025, through Porkbun LLC, resolved to IP 185.27.134.132 (AS34119, Wildcard UK Limited, GB) and was taken offline by July 23, 2026. The page title 'Default Web Page - ALC Hosting Networks' suggests the domain may have been repurposed or misconfigured to host phishing content, though the exact nature of the scam remains unconfirmed due to limited forensic evidence. Infrastructure analysis reveals the domain used nameservers ns1.byet.org through ns5.byet.org and employed Nginx with OpenResty, a common web server stack.

The SSL certificate was issued by Let's Encrypt (R13), providing HTTPS encryption but no inherent trust validation. Gridinsoft assigned a trust score of 0/100, reflecting its detection as malicious. VirusTotal flagged the domain with 15 detections out of 93 security vendors, and it appeared on one security blocklist, specifically PhishDestroy. Defenders should treat this domain as compromised infrastructure.

While the phishing kit's target (e.g., financial, credentials, or other) is not specified in available data, the combination of a default hosting page title and elevated detection rates warrants blocking at the DNS or proxy level. The domain's offline status as of the report date reduces immediate risk, but historical resolutions to 185.27.134.132 should be reviewed for lateral movement or persistence. No evidence links the domain to a specific brand or campaign beyond its classification as generic phishing.