stable-signup[.]net

Analysis of stable-signup.net indicates that the domain was registered on 29 October 2025 through NiceNIC International Group Co., Limited. The authoritative nameservers are damien.ns.cloudflare.com and nadia.ns.cloudflare.com, and the domain resolves to IP 172.67.209.155, which is part of Cloudflare’s AS13335 network located in the United States. The presence of Cloudflare and support for HTTP/3 suggest the site leveraged Cloudflare’s edge services for content delivery and possibly to obscure origin infrastructure. The TLS certificate is issued by Google Trust Services under the WE1 profile, confirming that HTTPS was correctly configured at the time of observation.

The only visible HTTP response is a 522 “Connection timed out” page title, indicating that the origin server failed to respond within Cloudflare’s timeout window. The domain is currently listed as offline, which may be the result of takedown actions or automated blocking. Independent security blocklists have flagged the domain; it appears on three blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal recorded scans from 95 AV engines with no detections, but the absence of detections does not constitute a safety assurance, especially given the phishing classification.

The available data confirms that stable-signup.net is being used for a generic phishing campaign, though the specific lure or targeted brand has not been disclosed in the observable artifacts. No additional payload, redirect chain, or credential‑harvesting page has been captured, leaving the exact malicious behavior uncertain. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the domain or associated IP ranges, and consider adding the IP address 172.67.209.155 to reputation lists. Ongoing intelligence collection is recommended to capture any future content changes or new indicators that may clarify the phishing vector.