shhhvps.com: Active Generic Phishing Site

Infrastructure analysis reveals that shhhvps.com was registered on April 28, 2026 via Fewmoretaps OU d/b/a Trustname.com. The domain uses Cloudflare nameservers gail.ns.cloudflare.com and woz.ns.cloudflare.com while resolving to IP address 91.229.91.108 hosted by Beget LLC in Russia. An active HTTP 200 response is returned along with a page titled Shhh VPN, and the certificate is issued by Let's Encrypt. These elements establish a functional web presence consistent with the assigned generic phishing classification and high risk level.

Detection records show the domain listed on one security blocklist and referenced in a single AlienVault OTX pulse. VirusTotal detection stands at 1 out of 95 vendors, while the Gridinsoft trust score registers 35 out of 100. The combination of recent registration, proxy nameservers, and blocklist presence supports ongoing threat monitoring without reliance on any single indicator.

Current status remains active as of July 12, 2026. Defenders should incorporate the exact IP 91.229.91.108, the listed nameservers, and the domain itself into blocklists and DNS filtering rules. Takedown requests can reference the registrar Fewmoretaps OU d/b/a Trustname.com and the hosting provider Beget LLC using the observed registration date and certificate details.

Uncertainties persist around the precise phishing targets or operator identities, since available data consists solely of aggregated intelligence hits rather than campaign-specific artifacts. Continued observation of resolution changes and blocklist updates is warranted to track any infrastructure shifts while maintaining focus on the concrete observables already documented.