stashpatric[.]mobi

This domain, stashpatric.mobi, is flagged as a high-risk credential phishing site, impersonating Patrickstash. The domain was created on March 02, 2026, and has been actively used for phishing operations since then. The site resolves to the IP address 176.123.0.199, which is located in MD and is part of the AS200019 ALEXHOST SRL network. The domain is registered through NiceNIC International Group Co., Limited, a registrar that has been associated with various suspicious activities in the past. Infrastructure analysis reveals that the domain is currently hosted on a server running LiteSpeed and supports HTTP/3, suggesting a modern and efficient web infrastructure that could facilitate rapid and effective attacks. The site also uses common web technologies such as Bootstrap, jQuery, and Popper, which are typical in phishing sites designed to mimic legitimate brand interfaces. While VirusTotal indicates that 4 out of 95 security vendors flag this domain, it is important to note that this low detection rate does not guarantee safety, as many phishing sites are designed to evade initial detection. Gridinsoft's trust score of 13 out of 100 further underscores the high-risk nature of this domain. Defenders should be particularly cautious, as the domain appears on one security blocklist and is blocked by PhishDestroy. It is recommended that network administrators and security teams take immediate action to block this domain and educate users about the risks of credential phishing. Monitoring for any unusual login attempts or credential leaks associated with this domain should be prioritized, and users should be advised to verify the legitimacy of any login pages they encounter, especially those related to Patrickstash or similar services. Additionally, implementing multi-factor authentication (MFA) can significantly reduce the risk of successful phishing attacks by adding an extra layer of security to user accounts.