subclick[.]top

The domain subclick.top was registered on March 11, 2026 through the Cosmotown registrar. DNS resolves to 192.142.54.88, an address owned by AS214036 Ultahost, Inc. and geolocated to the Netherlands. The authoritative nameservers are ns1.hostcreed.com and ns2.hostcreed.com. An MX record points to subclick.top itself, indicating the domain is capable of receiving email.

The web server presents a Let’s Encrypt R13 certificate and advertises LiteSpeed with HTTP/3 support. A page title retrieved during the brief online exposure reads “The United States Social Security Administration | SSA”, suggesting an attempt to imitate the official SSA site. VirusTotal analysis shows that two of ninety‑five security vendors flagged the domain, reinforcing the suspicion of malicious activity. The domain is listed on one external blocklist and has been explicitly blocked by the PhishDestroy service.

The current operational status is offline, as confirmed by the latest probe, but historical evidence indicates a generic phishing campaign targeting users of the Social Security Administration. Defenders should continue to block traffic to 192.142.54.88 and to the hostnames subclick.top and its MX target, add the domain to internal phishing and malware blocklists, and monitor for any re‑registration or re‑use of the same IP address or hosting provider. Because the site is no longer reachable, dynamic analysis is not possible, and further investigation should focus on email artifacts that reference the MX record, as well as any residual hashes or URLs captured by security sensors. Continuous observation of the hosting ASN for new phishing indicators is recommended.