pc[.]st7demo[.]com

The domain pc.st7demo.com was registered on October 7, 2024 through Gname.com Pte. Ltd. and presently resolves to the IP address 188.114.96.3, which belongs to the Cloudflare network (AS13335). The host is located in the United States and is serviced by the Cloudflare nameservers augustus.ns.cloudflare.com and imani.ns.cloudflare.com. The site returns HTTP status code 200 and presents a page title of “DEMO”, indicating an active web presence. Infrastructure analysis shows the site is built with Ant Design and Vue.js, and leverages Cloudflare Browser Insights and HTTP/3, suggesting a modern front‑end stack. Reputation services have assigned a Gridinsoft trust score of 0 out of 100, and the domain appears on three independent blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal scans report that three of ninety‑five security vendors have flagged the domain as malicious, reinforcing the suspicion of abuse. While the publicly visible page provides only a generic “DEMO” title, no additional content or credential‑harvesting forms have been captured in open‑source feeds. The limited visibility creates uncertainty around the exact phishing payload or targeted brand, and the absence of a known malware kit or payload hash prevents a definitive attribution. Nevertheless, the combination of a zero‑trust score, blocklist listings, and vendor flags points to a high likelihood of credential‑stealing intent. Defenders should treat pc.st7demo.com as a high‑risk indicator. Immediate actions include adding the domain and its resolving IP to deny‑list rules on perimeter firewalls and DNS filtering solutions, and monitoring for outbound connections to the IP address. Continuous passive DNS and TLS‑SNI surveillance is advised to detect any new subdomains or certificate changes. Incident response teams should also consider sandboxing any URLs observed in user reports to confirm malicious behavior.