deelstaffingservice[.]us

Analysis of the domain deelstaffingservice.us indicates it was actively used in a phishing campaign targeting corporate staffing and employment services. The domain was registered on February 21, 2026, through NameSilo, LLC, a registrar frequently observed in fraudulent registrations. Infrastructure analysis reveals the domain resolved to the IP address 89.163.155.33, hosted on AS24961 (WIIT AG) in Germany. SSL certification was provided by Let's Encrypt (R13), a common choice among threat actors due to its accessibility and automation. The site's page title, 'Deel Staffing Service | Global Office Solutions,' suggests an attempt to impersonate legitimate staffing or employment platforms, though no specific brand impersonation has been confirmed in available data.

Detection metrics from security vendors indicate elevated risk: three of 93 vendors on VirusTotal flagged the domain as malicious. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, further corroborating its classification as phishing infrastructure. Nameservers ns7.privatedns.vip and ns8.privatedns.vip are consistent with patterns observed in other phishing domains, often associated with bulletproof or low-reputation DNS providers. MX records point to the domain itself, a tactic occasionally used to lend superficial legitimacy or facilitate credential harvesting via email.

As of the report date, the domain has been taken offline, though historical resolution and detection data remain relevant for retrospective threat analysis. Defenders are advised to block the domain at the DNS level and monitor for related infrastructure, particularly domains registered through the same registrar or resolving to the identified IP range. No evidence of a specific phishing kit or targeted brand beyond the page title has been confirmed, and the exact content of the phishing page remains unanalyzed.