24hoursgcvisaservices[.]com

24hoursgcvisaservices.com was registered on 17 September 2025 through the Atak Domain registrar and is hosted on a HostPapa infrastructure (AS36352) in the United States, resolving to 198.23.141.202. The domain uses the authoritative nameservers ns1.sagaciousdns.com and ns2.sagaciousdns.com and does not present an SSL/TLS certificate, indicating an unencrypted HTTP service. The public page title returned by the server is “24Hours GC-Visa Services”, and the site is classified as a brand‑impersonation campaign targeting the “foundation” brand. Gridinsoft’s trust scoring system assigns a score of 0 out of 100, reflecting the highest risk rating.

The site has been taken offline and is currently flagged by the PhishDestroy takedown service. It appears on one external security blocklist, and VirusTotal reports that three of ninety‑five scanning engines have flagged the domain as malicious. No additional technical artifacts such as malware payloads or credential‑harvesting forms have been disclosed.

The absence of HTTPS, low trust score, and the presence of a brand‑impersonation page title collectively corroborate the malicious intent. Defenders should ensure that the domain is added to network‑level deny lists, update URL filtering policies to block any HTTP connections to 198.23.141.202, and monitor for newly registered domains that share the “gcvisa” or “24hours” lexical patterns. Continuous observation of the Atak Domain registrar and sagaciousdns.com nameserver activity is recommended to detect potential re‑use of the infrastructure for future campaigns.