stealtehx[.]top

Analysis of stealtehx.top indicates this domain was actively flagged as a credential-theft phishing site before being taken offline. The domain was registered on August 14, 2025, through Hosting Concepts B.V. d/b/a Registrar.eu and resolved to IP address 38.242.227.17, hosted on AS51167 (Contabo GmbH) in France. No SSL certificate was present, increasing the likelihood of plaintext credential interception. Nameservers were ns1.regery.net, ns2.regery.net, and ns3.regery.net, a pattern observed in other phishing campaigns leveraging bulletproof hosting providers. As of the last scan, three security vendors on VirusTotal flagged the domain, and it appeared on two security blocklists, including PhishDestroy and ScamSniffer.

Gridinsoft assigned a trust score of 0/100, further corroborating malicious classification. The page title, 'stealtehx.top,' suggests either a placeholder or a lack of effort to mimic a legitimate brand, though the exact content and target remain unconfirmed due to the site's offline status. No evidence links this domain to a specific phishing kit or brand impersonation. Defenders should treat this domain as compromised infrastructure.

The IP address and nameserver combination should be monitored for re-emergence under new domains. Network-level blocks at the IP and ASN level are recommended, particularly for organizations in sectors commonly targeted by credential phishing. Historical DNS records and passive DNS queries may reveal additional connected domains. Given the domain's recent registration and rapid takedown, it is likely part of a larger, short-lived phishing operation rather than a persistent campaign.