consulta-si-erees-beneficiariio[.]hstn[.]me

The domain consulta-si-erees-beneficiariio.hstn.me was first registered on 2019-06-03 through the registrar Porkbun LLC. DNS resolution points exclusively to the IPv4 address 185.27.134.118, and no authoritative nameserver records are returned in public queries, which may indicate the use of privacy-protected or dynamically updated name services. Google Safe Browsing has flagged the URL for "social engineering", a label commonly applied to credential-stealing pages that lure users into disclosing personal information. Independent scanning on VirusTotal reports that eleven out of ninety-one antivirus and URL-reputation engines have generated a detection for the domain, providing multiple independent confirmations of malicious behavior. The domain is currently listed on one public security blocklist and has been actively blocked by the community-driven PhishDestroy feed, confirming that operational defenders consider it hostile. Its status is marked as active, meaning the site continues to respond to requests at the time of reporting.

Available telemetry does not include the HTTP status code, TLS certificate details, or the page title, so those surface-level indicators remain unverified. The absence of such data does not mitigate the risk derived from the existing indicators. Defenders should therefore treat the domain as high-risk and enforce block-or-allow policies that deny any outbound or inbound traffic to the fully qualified domain name and to its resolved address 185.27.134.118. Adding the domain to DNS sinkhole configurations, proxy URL filters, and email gateway quarantine rules will prevent end-users from accessing the site or receiving malicious links that reference it.

Continuous monitoring of the IP address for additional hostnames is advised, as threat actors frequently reuse compromised or rented servers for multiple campaigns.