beehive[.]hostel[.]town

The domain beehive.hostel.town is currently active and has been identified as a generic phishing infrastructure. VirusTotal analysis shows that 17 out of 91 scanned security vendors have flagged the domain as malicious, indicating a moderate level of consensus among scanning engines. DNS resolution returns a single IPv4 address, 172.86.104.14, and the authoritative nameserver query fails (NS_NOT_FOUND), suggesting the domain relies on minimal DNS configuration or dynamic updates. The host is listed on two public phishing blocklists and is actively blocked by both PhishDestroy and OpenPhish, reinforcing its classification as a phishing resource.

Infrastructure assessment reveals only the IP address; no additional hosting or ASN information is available from the supplied data. Absence of SSL/TLS details, HTTP status codes, page title, or brand targeting means the payload and victim‑facing content have not been publicly documented. Consequently, the exact phishing lure and any compromised credentials remain uncertain. Defenders should immediately deny outbound connections to 172.86.104.14 and add beehive.hostel.town to URL filtering and DNS sinkhole policies.

Monitoring for new DNS records or changes in the IP address is advisable, as the current lack of nameserver data may indicate future re‑hosting. Inclusion of the domain in internal threat‑intel feeds will ensure that any emerging detections from additional scanners are correlated with the existing 17‑vendor flag count. Continuous review of blocklist updates from PhishDestroy, OpenPhish, and other anti‑phishing services is recommended to capture any further attribution or remediation actions.