test-castomername-wal[.]org

On 12 July 2026 analysis identified the domain test-castomername-wal.org as an active generic phishing site. The domain was registered on 28 April 2026 through Fewmoretaps OU d/b/a Trustname.com. It is presently listed on a single security blocklist and has been blocked by PhishDestroy. VirusTotal reports two detections out of ninety‑five scanning engines, indicating limited but confirmed malicious presence. The domain resolves to the IP address 1.1.1.1, which maps to an Australian location according to APNIC and Cloudflare DNS Resolver data. The authoritative name servers are zeus.trustname.com and ares.trustname.com, both consistent with the registrar’s naming scheme. TLS negotiation presents a certificate issued by SSL Corp under the SSL.com SSL Intermediate CA ECC R2 chain, confirming the use of valid‑looking encryption. HTTP requests to the host return a 403 Forbidden status and the page title is explicitly “403 Forbidden”, suggesting that the site is either temporarily inaccessible or deliberately restricting direct access to obscure its payload. The low Gridinsoft trust score of 0/100 and the presence in one AlienVault OTX pulse reinforce the likelihood of a phishing campaign, though the exact credential‑harvesting template and target brand remain undefined. Defenders should add test-castomername-wal.org to blocklists at the DNS and proxy layers and monitor outbound connections to 1.1.1.1 for any anomalous traffic. Email gateways should be updated to flag messages containing links to this domain, and incident response teams should inspect user reports for attempts to submit credentials. Ongoing surveillance of the associated name servers and certificate renewals is advised to detect any infrastructure changes that could indicate a shift in campaign tactics.