skladplzen[.]srv908353[.]hstgr[.]cloud

The domain skladplzen.srv908353.hstgr.cloud was first observed on March 01, 2026 and remains active as of the report date, July 12, 2026. It is classified as a generic_phishing campaign with a high risk rating. Automated analysis pipelines have flagged the site for credential‑stealing activity, and it is currently listed on a single security blocklist and blocked by PhishDestroy.

Infrastructure analysis shows the domain resolves to the IP address 168.231.111.45, which is announced by AS47583 belonging to Hostinger International Limited. The IP is geolocated to Germany. Registration was performed through HOSTINGER operations, UAB, and the domain is served by the authoritative nameservers any1.hostinger.com and any2.hostinger.com. The site presents a valid Let’s Encrypt certificate (R13) that enables HTTPS connections without certificate errors.

Web‑application inspection returned HTTP status 200 and identified the page title "SkladPlzen - Doplnění zboží do Plzně". The underlying stack includes Python, SimpleHTTP, and assets delivered via the Unpkg CDN, indicating a lightweight custom server rather than a commercial phishing kit. The Gridinsoft trust score is 0 out of 100, and VirusTotal reports a single positive detection out of 95 security vendors, reinforcing the suspicion that the site is malicious despite limited vendor consensus.

Uncertainty remains around the full scope of the campaign, including the number of targeted credentials and any additional infrastructure that may be used for data exfiltration. Defenders should block the domain and its associated IP at network perimeters, monitor DNS queries for the Hostinger nameservers, and enforce strict email authentication to reduce exposure to credential‑phishing attempts. Continuous re‑evaluation of VirusTotal results and inclusion of the domain in internal threat‑intel feeds are recommended to capture any future activity.