static[.]red-hat[.]shop

static.red-hat.shop is currently listed as an active generic phishing infrastructure. DNS resolution points exclusively to the IPv4 address 52.54.199.95; the authoritative name servers could not be retrieved, indicating either a misconfiguration or deliberate concealment. VirusTotal analysis shows that 14 of 91 security vendors have flagged the domain as malicious, reinforcing the high‑risk assessment. No additional contextual data such as page titles, brand impersonation, or malware kits have been disclosed, so the exact phishing lures employed remain unknown. The observed infrastructure suggests a low‑profile hosting arrangement, potentially leveraging cloud or shared services to minimize attribution. Defenders should immediately block both the domain and its resolved IP at perimeter and endpoint controls, incorporate the indicator into threat‑intel feeds, and monitor for any related DNS or network activity. Continuous re‑evaluation is advised, as further evidence (e.g., payload samples or phishing page screenshots) may emerge that clarifies the campaign’s objectives and target audience.