speal[.]net

Analysis indicates that speal.net was registered on 21 February 2026 and currently resolves to the IPv4 address 49.51.191.158, which is announced by ASN 132203 and hosted within a Tencent facility in the United States. The server presents an SSL certificate identified as R12, confirming the use of TLS for encrypted transport. Automated scanning on VirusTotal recorded detections from three of ninety‑three security vendors, and Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence of malicious intent. The domain is listed on one public blocklist and has been added to three AlienVault OTX pulses, indicating that threat‑intel feeds have correlated the infrastructure with prior phishing campaigns.

PhishDestroy has also flagged the site, and the observed page title “Log in” aligns with the reported credential‑phishing campaign. The site is presently offline, which may be due to takedown actions or temporary suspension. Defenders should continue to block DNS resolution for speal.net and the associated IP address 49.51.191.158, enforce URL filtering, and monitor network traffic for attempts to contact the host.

Email gateways should be tuned to detect messages that reference the “Log in” title or reference the domain. Continued observation of the IP’s ASN and related Tencent hosting assets is recommended to identify any re‑use of the infrastructure for future campaigns. Indicators of compromise are limited to the domain name, IP address, SSL certificate identifier, and the associated blocklist entries.