launch-stable[.]net

The domain launch-stable.net was registered on November 04, 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the address 104.21.39.84, located in the United States. DNS resolution is served by louis.ns.cloudflare.com and veronica.ns.cloudflare.com. No TLS certificate was observed, indicating the site was served over plain HTTP at the time of capture. The page title returned by the server was "Just a moment..." and no further content was retrieved before the site was taken offline.

VirusTotal analysis recorded four detections out of ninety‑five scanned security vendors, suggesting that a minority of scanners identified malicious behavior. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. AlienVault OTX references include one threat‑intel pulse linking the domain to malicious activity. The overall risk rating is elevated and the threat type is classified as a generic phishing operation with a specific focus on a crypto‑related scam.

Because the site is currently offline, dynamic analysis of payloads, redirects, or credential‑harvesting mechanisms is not possible; therefore the precise tactics, techniques, and procedures employed remain uncertain. Defenders should continue to block the domain at network perimeter devices, update DNS sinkhole entries, and monitor for any re‑registration attempts. Additional scrutiny of traffic to the associated IP address and Cloudflare name servers is advised, as these assets may be reused for future campaigns. Continuous observation of threat‑intel feeds, including VirusTotal and OTX, will help detect re‑emergence of the domain or related indicators of compromise.