stpatty[.]xyz

This domain, stpatty.xyz, is currently active and serves a generic phishing payload. VirusTotal has recorded five detections out of ninety‑one scanned security vendors, indicating that a minority of AV engines have identified malicious behavior. The registrar is Name.com, Inc., and the authoritative name servers are ns1.vercel-dns.com and ns2.vercel-dns.com, suggesting the site is hosted on Vercel infrastructure. An HTTP GET returns a 200 status code, confirming that the web server is responding normally.

The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy filtering service, reinforcing its classification as a high‑risk phishing vector. No additional intelligence such as page title, SSL certificate details, or IP address attribution is available, leaving the precise content and target brand of the phishing page undisclosed. Defenders should immediately add stpatty.xyz to DNS‑based blocklists and firewall deny rules, monitor for any resolution attempts against the Vercel name servers, and flag any outbound connections to the domain. Continuous observation of VirusTotal updates is advised, as additional vendor detections may emerge.

Because the site returns a successful HTTP response, it can be used to host credential‑stealing forms or redirect victims to further malicious hosts, so endpoint protection solutions should treat any traffic to this domain as suspicious. Organizations employing web‑proxy or secure web gateway controls should enforce strict URL filtering for stpatty.xyz and consider quarantine of any email messages containing links to this domain. Ongoing threat‑intel feeds should be consulted for potential expansion of the blocklist presence and for any future attribution of the phishing campaign.