connectauth[.]hstn[.]me

The domain connectauth.hstn.me is currently active and classified as a high‑risk generic phishing site. Infrastructure analysis shows it resolves to the IPv4 address 185.27.134.219, which is hosted in the United Kingdom and belongs to AS34119 Wildcard UK Limited. The authoritative nameservers are ns1.byet.org through ns4.byet.org, indicating use of a shared hosting provider. Registration information lists Porkbun LLC as the registrar, with the domain creation date of June 03, 2019. The site presents an HTTPS certificate issued by ZeroSSL ECC Domain Secure Site CA, but the certificate does not mitigate the malicious intent. Google Safe Browsing flags the domain for social engineering, and VirusTotal records 12 detections out of 95 scanned vendors, reflecting consensus among security tools. Additional reputation data includes a Gridinsoft trust score of 0/100, placement on five blocklists, and active blocking by services such as PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. The HTTP response returns status code 200, and an MX record is configured pointing to mx.hstn.me, which may be used for credential harvesting. While the page title "Clock error" provides no insight into the payload, the combination of hostile indicators suggests the domain is being leveraged for credential‑stealing or similar phishing campaigns. Defenders should immediately block network traffic to both the domain and its resolved IP, enforce URL filtering for the domain, and monitor email systems for the associated MX host. Continuous threat‑intel feeds should be consulted for any emerging indicators, and incident response teams should be prepared to investigate potential compromises originating from this infrastructure.