shellinvestment[.]org

This domain, shellinvestment.org, was registered on November 12, 2025, through NameSilo, LLC, and remains active as of July 27, 2026. Infrastructure analysis reveals it resolves to the IP address 157.173.209.41 and uses nameservers ns1.dns-parking.com and ns2.dns-parking.com, a configuration often associated with low-cost or bulletproof hosting environments. The domain is flagged by one security vendor on VirusTotal and appears on a single security blocklist, indicating early-stage detection rather than widespread recognition. PhishDestroy has blocked access to this domain, suggesting confirmation of phishing activity targeting the Shell brand or related financial services.

No additional details regarding the specific phishing kit, page content, or targeted user actions are available at this time. The domain’s registration age (eight months) and continued activity suggest it may be part of an ongoing campaign rather than a short-lived operation. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level.

Monitoring for related domains using the same nameservers or IP range may uncover additional infrastructure linked to this threat actor. Further analysis of the resolved IP address and associated domains could provide insight into the broader campaign scope. If internal logs indicate user interaction with this domain, immediate incident response measures should be initiated to assess potential credential compromise or malware exposure.