shutdown[.]st

PhishDestroy identifies shutdown.st as an active generic phishing domain targeting unsuspecting users with a fake system shutdown alert. The domain mimics legitimate system messages to trick victims into entering credentials or downloading malware. No specific brand or drainer kit has been tagged yet; however, the site’s payload appears to harvest user inputs under the guise of a critical system alert. The infrastructure is designed to appear urgent, leveraging a decoy interface that mimics system shutdown prompts to increase user panic and reduce critical judgment during the attack. The campaign is still under behavioral analysis to identify full payload mechanics and campaign scope.

This domain was registered on October 16, 2025, and resolves to IP address 188.114.96.3. According to VirusTotal, shutdown.st currently has 1 out of 95 detection engines flagging it as malicious, indicating it has flown under the radar despite being recently live. The domain is registered through StanCo and Istanco, which are known for bulk registration services often exploited by malicious actors. The site holds a valid SSL certificate issued by Google Trust Services, which may help it bypass automated filters that flag non-HTTPS domains. To date, this domain has not appeared on any known blocklists, suggesting a potential zero-day deployment aimed at evading early detection systems.

The current status of this campaign is active and under active investigation. No takedown has been executed yet due to the low VT detection footprint. Users and organizations are advised to block shutdown.st at the network level using DNS filtering or firewall rules. Additional IOCs such as IP 188.114.96.3 should also be blocked to prevent lateral movement. Remaining risk is assessed as HIGH due to the combination of zero detections, valid SSL, and mimicked urgency. Organizations are urged to monitor for credential submission attempts to this domain and update user awareness training focusing on fake system alerts and shutdown scams. The low initial detection rate suggests this may be part of a larger, evolving campaign, warranting heightened vigilance across security teams.