shaventrade[.]com[.]stableprimeinv[.]org

The domain shaventrade.com.stableprimeinv.org was registered on March 11, 2026 through Ultahost, Inc. and is serviced by four Ultahost name servers (ns1‑ns4.ultahost.com). DNS resolution points to IP address 159.100.6.5, which belongs to AS214036 Ultahost, Inc. and is geolocated to Germany. An active TLS certificate issued by Let’s Encrypt (R12) secures the site, and network fingerprints show the use of PHP, LiteSpeed web server, Smartsupp chat integration, and HTTP/3. The page title reported by crawlers is "Shaventrade - Smart Investment Platform," indicating an attempt to masquerade as a legitimate investment service.

VirusTotal analysis recorded two detections out of ninety‑five scanners, and the domain is listed on a single public blocklist, currently blocked by PhishDestroy. The site’s status is reported as offline at the time of analysis. Observable evidence confirms the presence of typical phishing infrastructure—rapid domain registration, shared hosting, a valid SSL certificate, and minimal vendor detections—without revealing the specific payload or credential‑ harvesting mechanisms.

Uncertainty remains regarding the exact phishing kit, targeted user base, and whether any compromised credentials were exfiltrated before the takedown. Defenders should block the domain and its associated IP, monitor for similar Ultahost‑hosted infrastructure, and update detection signatures to include the observed page title and technology stack. Continuous re‑query of passive DNS and threat‑intel feeds is recommended to detect potential re‑use of the same hosting assets for future campaigns.