dolondtremp[.]com

Analysis of dolondtremp.com indicates that the domain was registered on 25 September 2025 through Tucows Domains Inc. The domain resolves to the IPv4 address 85.206.242.208, which is announced by AS61272 Informacines sistemos ir technologijos, UAB and geolocated to Lithuania. The hosting environment is served by four nameservers – dns1.bacloud.com, dns2.bacloud.com, dns1.laisvas.lt and dns2.laisvas.lt – a configuration commonly observed in malicious infrastructure that leverages multiple DNS providers for redundancy. The site currently returns an HTTP response with the page title “Account Suspended” and presents no SSL certificate, indicating that any credential capture would occur over unencrypted HTTP. VirusTotal scans have recorded three detections out of ninety‑five vendors, confirming that at least a subset of security products have identified malicious activity associated with this host.

The domain is listed on two dedicated phishing blocklists, PhishDestroy and ScamSniffer, and both blocklists have flagged it as an account‑takeover phishing vector. Risk assessment assigns an elevated level, consistent with the observed indicators of compromise and the presence on multiple blocklists. Although the domain is reported as taken offline at the time of this analysis, the underlying IP address and DNS infrastructure remain active and could be reused for future campaigns.

Defenders should continue to block both the domain and its resolving IP, update internal threat‑intel feeds with the observed nameserver set, and monitor for any re‑registration of the host. Additional scrutiny of outbound traffic to the 85.206.242.208 address is recommended, and any attempts to contact the domain should be logged and investigated. Continuous re‑scanning of the domain on multi‑vendor platforms is advised to capture any changes in detection status.