reserveng[.]net

Analysis of reserveng.net shows a domain that was created on March 16, 2025 and is currently taken offline. The site resolved to the IPv4 address 159.100.6.5, which is geolocated to Germany and is associated with the hosting provider UltaHost Inc. All four authoritative name servers (ns1.ultahost.com through ns4.ultahost.com) belong to the same provider, indicating a single‑point hosting environment. The web server stack identified Nginx running OpenResty, a common combination for high‑performance sites but also frequently used by malicious operators to serve dynamic phishing content. The domain presented a valid TLS certificate issued by Let’s Encrypt (R13), meaning HTTPS connections would appear trusted to end users despite the underlying malicious intent.

Reputation services uniformly flag the domain as highly suspicious: Scamadviser assigned a trust score of 1 out of 100, Gridinsoft reported 0 out of 100, and the domain appears on at least one security blocklist. VirusTotal scans show that seven of ninety‑four antivirus and URL‑filtering engines flagged the site, reinforcing the suspicion. The page title returned by the live endpoint before takedown was "Home - ING," suggesting an attempt to impersonate the financial institution ING, although no further content analysis is available.

PhishDestroy has already blocked the domain, and its inclusion on a dedicated phishing blocklist further confirms its malicious purpose. Defenders should continue to block 159.100.6.5 and any sub‑domains resolved from the UltaHost name servers, monitor outbound traffic for attempts to contact this IP, and ensure that email filters reference the domain name and associated indicators. Because the site is offline, active probing is limited; however, threat‑intel feeds should be updated with the domain, its registration details, and the observed TLS certificate to improve detection of any future re‑hosting attempts.