con[.]signalstacktrend[.]live

Analysis as of July 29, 2026 indicates that the domain con.signalstacktrend.live is actively being used for credential harvesting. The infrastructure resolves to the IPv4 address 192.142.10.129, and DNS queries return no authoritative name server records, as indicated by the NS_NOT_FOUND status. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service. VirusTotal scans show that 22 of 91 antivirus and URL‑reputation engines have flagged the domain as malicious, reinforcing the elevated risk rating assigned by analysts.

No additional metadata such as page title, SSL certificate details, or HTTP response codes are presently available, limiting visibility into the exact phishing content or any targeted brand. Consequently, the precise lure employed by the site remains uncertain, and investigators have not yet captured a snapshot of the landing page or its associated payloads. Defenders should prioritize network‑level controls by adding con.signalstacktrend.live and the associated IP address 192.142.10.129 to deny‑list rules on DNS resolvers, firewalls, and web proxy filters.

Continuous monitoring of outbound traffic for connections to this IP is advised, as is the inclusion of the domain in endpoint detection and response (EDR) indicator sets. Given the active status and elevated risk, organizations should also educate users about the possibility of credential‑stealing attacks originating from seemingly unrelated domains and reinforce multi‑factor authentication wherever possible. Ongoing threat‑intel feeds should be consulted for any future updates on page content, additional blocklist appearances, or changes in the hosting infrastructure that could affect remediation strategies.