savestan0[.]cc

The domain savestan0.cc was registered on March 26, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolved to the Cloudflare‑owned address 188.114.97.3, which resolves to a Canadian location associated with Cloudflare, Inc. The authoritative nameservers are eleanor.ns.cloudflare.com and peter.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 designation, indicating a valid certificate chain despite the malicious use. HTTP requests return a 403 status code and the page title is reported as “Just a moment…”, suggesting the site is deliberately restricting direct access. Threat intelligence indicates the site is classified as a brand impersonation phishing campaign and is listed as active with a high risk rating. VirusTotal analysis shows four of ninety‑four security vendors flag the domain, and AlienVault OTX includes it in a single threat pulse. The domain is currently blocked by PhishDestroy and appears on one additional security blocklist. Independent scoring from Gridinsoft assigns a trust score of 15 out of 100, reinforcing the low confidence in its legitimacy. While the exact phishing payload or targeted brand is not disclosed, the available indicators confirm malicious intent. Defenders should add savestan0.cc to network and endpoint blocklists, monitor DNS queries for the associated IP address, and enforce TLS inspection to capture any encrypted payloads. Continuous threat‑intel feeds should be consulted for updates, and any observed traffic to the domain should be logged and investigated for potential credential harvesting attempts.