equinuxglobalassets[.]com

Analysis on equinuxglobalassets.com (registered through Dynadot Inc on 28 December 2024) shows that the domain currently resolves to the IPv4 address 66.70.148.19. The authoritative name servers listed are ns5.ddoscure.com, ns6.ddoscure.com, protected3.ddoscure.com, and protected4.ddoscure.co, indicating that the infrastructure is hosted on the ddoscure DNS network. The site is served over HTTPS using a Let’s Encrypt certificate, which is automatically issued and does not provide any insight into the operator’s identity. VirusTotal reports that 1 of 91 scanned vendors flagged the domain, and the domain appears on a single public blocklist. PhishDestroy has already added it to its blocklist, and AlienVault OTX cites the domain in two separate threat‑intel pulses, reinforcing the likelihood of malicious use.

The risk rating assigned by the source is high, and the operational status is listed as active. Taken together, the evidence points to a high‑confidence phishing deployment that is actively resolving and being used to target victims. The limited number of detections (one vendor flag) may reflect either a short observation window or evasion techniques, but the presence on multiple reputable blocklists and OTX pulses outweighs the low detection count. No public page title or brand attribution has been disclosed, so the exact lure or credential‑stealing vector remains unknown.

Defenders should block DNS resolution to 66.70.148.19 and add the domain and its four name‑server entries to URL filtering and proxy deny lists. Continuous monitoring of the IP address and associated DNS records is advised, as the infrastructure could be repointed to additional hosts. Organizations using threat‑intelligence feeds should ingest the PhishDestroy blocklist entry and the OTX pulses to ensure rapid detection. Because the domain is newly created (December 2024) but already active, any inbound traffic matching the domain should be treated as malicious.