sstholding[.]org

Analysis conducted on July 25, 2026 indicates that the domain sstholding.org was registered through Hostinger operations, UAB on March 11, 2026. The domain resolves to the IP address 84.200.81.231, which belongs to the German network Ultahost, Inc. (AS214036). DNS resolution is delegated to Cloudflare nameservers carla.ns.cloudflare.com and cleo.ns.cloudflare.com, and the site served an HTTPS certificate issued by Let’s Encrypt (R12). A page title retrieved before the site was taken offline reads “SST Holding (Secure Settlement Technologies Holding) – Home”.

Technical fingerprinting shows the server runs Ubuntu with Nginx, and the front‑end leverages Bootstrap, jQuery, and jQuery UI. The Gridinsoft trust score of 21 / 100 reflects a low reputation rating. VirusTotal scans reported that two of ninety‑five antivirus engines flagged the domain, and the domain appears on a single security blocklist, currently blocked by PhishDestroy. The intelligence tags the activity as a crypto‑related scam that impersonates the brand “across”.

The combination of a recent registration, low trust score, minimal detection by antivirus vendors, and active blocklist listing suggests malicious intent, although the limited number of detections means the payload or malicious infrastructure has not been fully observed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor the associated IP address for any re‑use, and consider adding the domain to internal threat intelligence feeds. Further investigation is recommended to capture any phishing pages or malware binaries that may have been hosted before the takedown, and to verify whether the impersonated brand “across” is being targeted in broader campaigns.