s1119659[.]ha007[.]t[.]mydomain[.]zone

The domain s1119659.ha007.t.mydomain.zone presents a 403 Forbidden page, indicating it is a web resource that denies access to its content. Based on the page title, the site offers no visible brand or service, but its association with a blocklist and low trust score suggests it is configured to restrict visibility while potentially hosting malicious or unauthorized content. The primary threat is that the site may be used for phishing, malware distribution, or as a command-and-control endpoint, given its high detection rate and offline status.

Technical evidence shows the domain is flagged by 16 out of 95 VirusTotal vendors, with specific detections from ADMINUSLabs, BitDefender, CRDF, Cluster25, and Criminal IP. It is listed on one blocklist. The domain was registered on 2026-02-26 through GoDaddy.com, LLC, and resolves to IP address 176.32.32.21 in Russia, hosted by AS51659 LLC Baxet. SSL certification is provided by Let's Encrypt with fingerprint E8. Nameservers are ns1.justhost.ru, ns1.mydomain.zone, ns2.justhost.ru, and ns2.mydomain.zone.

The domain is currently DOWN/OFFLINE, with a GridinSoft trust score of 0/100, indicating a high-risk classification. The combination of a recent creation date, Russian hosting, multiple vendor detections, and offline status suggests the site was likely used for short-lived malicious activity and has been taken down or deactivated. The risk level is high, as the domain poses potential threats to users if accessed.