absasavings[.]online

Analysis of the domain absasavings.online indicates it was actively impersonating Google as part of a tech support scam operation. The domain, registered on February 21, 2026, resolved to the IP address 198.12.93.82, hosted on AS36352 (HostPapa) in the United States. At the time of assessment, the site was offline, though prior activity was confirmed through observable infrastructure and detection data. The page title, 'Welcome to | absasavingsonline,' suggests an attempt to mimic a legitimate savings or financial service portal, aligning with the reported scam classification as a tech support scheme. Security vendor detections were limited but notable: two of 93 engines on VirusTotal flagged the domain, and it appeared on at least one security blocklist (PhishDestroy).

The domain's Gridinsoft trust score of 0/100 further reinforces its high-risk classification. The SSL certificate, issued by R11, does not provide meaningful trust validation, as such certificates are commonly used in low-reputation or malicious domains. No evidence of Safe Browsing or OTX listings was provided, though the domain's inclusion on PhishDestroy and its offline status suggest prior malicious activity was identified. Defenders should treat this domain as confirmed malicious infrastructure.

While the site is no longer active, the registration date, hosting provider, and detection history indicate it was part of a deliberate impersonation campaign. Organizations should monitor for related domains using similar naming conventions (e.g., 'savingsonline') or infrastructure patterns, particularly those hosted on AS36352. If internal logs or proxy data show prior connections to 198.12.93.82, these should be investigated for potential exposure to the scam. Given the domain's offline status, no immediate remediation is required, but historical forensic analysis may be warranted for affected entities.