stashpatrick[.]bz

stashpatrick.bz is currently active and classified as a high‑risk credential phishing site. The page title observed is “Stashpatrick - Patrickstash”. An HTTP 200 response confirms a live service, and the domain resolves to 188.114.97.3. It is listed on at least one security blocklist.

Technical fingerprinting reveals a PHP‑driven front‑end styled with Bootstrap and loading external libraries from jsDelivr, cdnjs, jQuery and Popper. Cloudflare Browser Insights and Cloudflare CDN are present, confirming use of Cloudflare’s edge network. DNS is served by quinton.ns.cloudflare.com and rihana.ns.cloudflare.com, and the SSL certificate is issued by Google Trust Services under the WE1 root, providing a valid TLS chain.

Threat intelligence feeds have labeled this domain as a credential phishing vector. It is blocked by PhishDestroy and carries a Gridinsoft trust score of 0 / 100, indicating a malicious reputation. VirusTotal reports seven detections out of ninety‑five scanned engines, reinforcing the malicious assessment. Although it appears on a single external blocklist, the low trust score and multiple detections suggest active exploitation.

Defenders should treat traffic to stashpatrick.bz as malicious. Immediate actions include adding the domain to deny‑list filters, deploying sink‑hole redirection, and monitoring DNS queries for the associated Cloudflare nameservers. Continuous observation of the site for credential‑harvesting forms is recommended to confirm the exact payload. Because the infrastructure relies on Cloudflare’s shared IP space, broader network‑level blocking may affect legitimate services; therefore, rule sets should target the exact FQDN. Ongoing threat‑intel correlation is advised to detect any pivoting to related domains or new hosting patterns.