stands-x[.]com

Analysis conducted on July 23, 2026 identifies stands-x.com as an offline domain that was used for a generic social media phishing campaign, as indicated by the classification “Social Media Phishing” in the intelligence feed. The domain was registered on January 04, 2026 through REALTIME REGISTER B.V. and points to the IP address 104.21.22.143, which belongs to AS13335 owned by Cloudflare, Inc., located in the United States. The authoritative nameservers for the zone are george.ns.cloudflare.com and sky.ns.cloudflare.com, confirming that the site was hosted behind Cloudflare’s CDN service. No TLS certificate was observed for the host, meaning the site was reachable only over HTTP. The page title returned during the brief scan was “Exclusive Invite-Only Release”, which aligns with typical lure tactics that promise exclusive content to entice victims.

The domain received a Gridinsoft trust score of 0 out of 100, reflecting an extremely low reputation. VirusTotal analysis recorded six detections out of ninety‑three submitted security vendors, indicating that several scanners recognized malicious characteristics. Additionally, the domain is listed on two public blocklists and has been manually blocked by the phishing‑filtering services PhishDestroy and ScamSniffer. Because the site is currently offline, active probing is not possible, and the exact content of the landing page remains unverified beyond the page title.

The lack of a certificate and the low trust score suggest that the infrastructure was intentionally minimal and likely intended for a short‑lived campaign. Defenders should continue to block any outbound connections to 104.21.22.143 and add stands-x.com to domain‑based deny lists. Monitoring for re‑registration or similar domains that reuse the same registrar or hosting provider is advisable, as threat actors often recycle Cloudflare‑based assets.