stashpetrick[.]name

stashpetrick.name is currently listed as a high‑risk generic phishing site. The domain was registered on 2026‑03‑03 through PublicDomainRegistry.com (PDR Ltd.) and resolves to 172.96.186.214, an address owned by AS32475 Internap Holding LLC in the United States. The hosting environment reports Nginx and OpenResty, and the TLS certificate is a Let’s Encrypt R12 issuance, indicating a recent, automated provisioning process. Both authoritative name servers are ns1.hawkhost.com and ns2.hawkhost.com, which are commonly associated with shared‑hosting services.

When accessed over HTTPS the server returns HTTP 200 and presents a page whose title reads “One moment, please…”, a pattern frequently employed by credential‑harvesting portals that delay the user while background scripts initialize. The site is presently blocked by PhishDestroy and appears on a single external blocklist, while VirusTotal shows a single security vendor flagging the domain. The Gridinsoft trust score of 0 / 100 further underscores the malicious nature of the host.

Publicly available intelligence does not disclose which legitimate brand or service the page attempts to imitate, and no malicious payloads or redirects have been captured in the limited samples. Consequently, the exact phishing lure remains uncertain, but the combination of a freshly registered domain, low‑reputation hosting, and a deliberately ambiguous loading page aligns with typical credential‑stealing campaigns.

Defenders should immediately add stashpetrick.name to outbound and inbound URL filtering rules, enforce sink‑hole redirection for any DNS queries, and monitor network traffic for connections to 172.96.186.214. Continuous scanning of the IP address for additional malicious endpoints is advised, as shared‑hosting environments can host multiple threats. Incident response teams should also collect any observed phishing emails that reference this domain to aid in attribution and to refine detection signatures.