stimulusupport[.]org

This domain, stimulusupport.org, is flagged for hosting a generic phishing campaign impersonating a Cost-of-Living Support Program. The threat type involves fraudulent financial assistance claims, likely designed to harvest personally identifiable information (PII) or distribute malware under the guise of government aid. Analysis indicates an elevated risk level due to its recent creation, low detection threshold, and association with known malicious infrastructure. Infrastructure analysis reveals the domain was registered on April 25, 2025, through NameCheap, Inc., a registrar frequently leveraged by threat actors for rapid domain deployment. It resolves to the IP address 91.222.173.30, located in the Netherlands under AS43641 (SOLLUTIUM EU Sp z.o.o.), an autonomous system previously linked to phishing and malware distribution. At the time of assessment, the domain was detected by 9 out of 95 security vendors on VirusTotal, a relatively low detection rate that may indicate evasion techniques or recent activation. The SSL certificate, issued by Let's Encrypt (R13), provides minimal assurance, as it is commonly used by both legitimate and malicious sites. The domain appears on one security blocklist and is blocked by PhishDestroy, further corroborating its malicious classification. The page title, Cost-of-Living Support Program, aligns with social engineering tactics targeting economically vulnerable individuals. Mitigation steps for this threat type include immediate blocking of the domain and its resolving IP (91.222.173.30) at the network perimeter. Organizations should deploy email filtering rules to quarantine messages referencing stimulusupport.org or similar aid-themed lures. End-users should be educated on recognizing phishing indicators, such as unsolicited aid offers, mismatched URLs, and requests for sensitive information. Monitoring for secondary domains registered through NameCheap or resolving to the same IP range (91.222.173.0/24) is recommended to identify related campaigns. Given the domain's recent creation and low detection rate, proactive hunting for similar infrastructure (e.g., AS43641-hosted domains) may uncover additional threats. Incident response teams should treat any interaction with this domain as a potential compromise of PII or credentials.