org-received-funds[.]sbs

org-received-funds.sbs was registered on 08 December 2025 through Global Domain Group LLC and resolves to the Amazon-owned address 199.59.243.228 (AS16509, United States). The domain is served by the registrar’s default nameservers ns1.globaldomaingroup.com and ns2.globaldomaingroup.com. No SSL certificate is present, indicating only HTTP access was available. The site was taken offline before the report date, but historical data shows the page title returned exactly “org-received-funds.sbs”, suggesting the landing page was either empty or used a generic placeholder.

Threat intelligence links the domain to an “Airdrop Scam” phishing kit, a pattern that typically promises cryptocurrency airdrops to harvest credentials. Detection telemetry records the domain on one security blocklist and 15 of 95 VirusTotal scanners flagged it as malicious. AlienVault OTX includes the domain in a single pulse, and the Gridinsoft trust score is 0 / 100. PhishDestroy has already blocked the domain.

The combination of a newly created domain, cloud hosting on Amazon, lack of TLS, and a zero trust score aligns with known infrastructure used for short‑lived phishing campaigns. Uncertainty remains around the exact content that was delivered, as no live HTTP response or screenshots are available. Defenders should immediately add org-received-funds.sbs to URL and domain blocklists, enforce outbound filtering for the associated IP 199.59.243.228, and monitor for re‑registration or DNS changes. Additional safeguards include heuristic detection for Airdrop Scam kit patterns and routine scanning of newly created domains hosted on the same ASN.