f858u37z6dyaz22[.]com

Analysis of the domain f858u37z6dyaz22.com indicates it was registered on February 21, 2026, through Tucows Domains Inc. and is associated with nameservers hosted under Njalla, specifically 1-you.njalla.no, 2-can.njalla.in, and 3-get.njalla.fo. The domain resolved to the IP address 91.202.233.160, which is geolocated in Russia and linked to AS200593 (PROSPERO OOO). At the time of assessment, the domain returned an HTTP 200 status code, though no SSL certificate was present, increasing the risk of unencrypted data transmission. Detection data from security vendors reveals limited but concerning signals: two out of ninety-three vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist.

The domain has since been taken offline, with PhishDestroy listing it as blocked. The absence of an SSL certificate, combined with its hosting on infrastructure historically linked to malicious activity, aligns with patterns observed in generic phishing campaigns. However, the exact content or target brand of the phishing site remains unconfirmed, as no page title, kit, or specific scam type was identified in available intelligence. Defenders should treat this domain as a potential phishing threat, particularly given its association with a hosting provider frequently used for malicious purposes.

Network-level blocking of the IP 91.202.233.160 and monitoring for related domains under the Njalla nameserver infrastructure are recommended. The domain’s offline status suggests mitigation efforts may already be in place, but historical resolution data should be reviewed to identify any residual exposure. Further analysis of captured traffic or forensic evidence would be required to determine the full scope of the campaign.