stealthex[.]run

The domain stealthex.run was registered on 2026-02-25 through PDR Ltd. d/b/a PublicDomainRegistry.com. Infrastructure analysis shows the domain resolves to IP 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain uses Cloudflare’s default authoritative name servers irma.ns.cloudflare.com and konnor.ns.cloudflare.com. No TLS certificate is present, indicating the site was served over plain HTTP before being taken offline.

Threat intelligence flags the site as a crypto‑scam that impersonates Bitcoin. The page title retrieved before takedown reads "StealthEX Crypto Exchange – Instant Crypto Swap & Buy Bitcoin | StealthEX Exchanger", matching the branding of the legitimate StealthEX service and suggesting a deceptive attempt to lure cryptocurrency users. The domain appears on three independent security blocklists and has been actively blocked by PhishDestroy, MetaMask, and the SEAL initiative. VirusTotal analysis recorded a single positive detection out of 93 scanning engines, reinforcing the malicious classification.

The current online status is offline, and no content is reachable for direct analysis, leaving the exact phishing flow and payload unknown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the associated IP address to reputation filters. Given the Cloudflare hosting, threat actors may shift to alternative Cloudflare‑hosted IPs, so ongoing observation of the ASN and related CNAME patterns is advised. Incident response teams should also alert users of the StealthEX brand to verify any unexpected communications referencing stealthex.run, as the domain has demonstrated a clear intent to misuse the Bitcoin brand for fraudulent crypto transactions.