aleph-cloud[.]xyz

Analysis of aleph-cloud.xyz indicates that the domain is being used for credential phishing. The domain was registered on 12 October 2025 through OwnRegistrar, Inc. and is currently hosted behind Cloudflare, resolving to IP 104.21.75.117, which belongs to AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services under the WE1 certificate profile, providing HTTPS with HSTS enabled. Cloudflare services are evident from the presence of Cloudflare Browser Insights and support for HTTP/3. The authoritative name servers are audrey.ns.cloudflare.com and lewis.ns.cloudflare.com, consistent with the hosting provider. A single MX record points to _dc-mx.991d34408da3.aleph-cloud.xyz, suggesting potential use for outbound mail but no further verification data is available.

Threat intelligence sources flag the domain as malicious: five of ninety‑five security vendors on VirusTotal have marked it, and it appears on one security blocklist, where it has been blocked by PhishDestroy. The page title returned from the site is “Nur einen Moment…”, a German phrase meaning “Just a moment…”, which is commonly used by phishing pages to delay user interaction. The Gridinsoft trust score of 0/100 reinforces the low legitimacy assessment. Uncertainty remains regarding the exact content delivered to victims, as the site has been taken offline and no visual or functional analysis is available.

No additional public reports, OTX entries, or Safe Browsing alerts are referenced in the current data set. Defenders should block network traffic to 104.21.75.117, add aleph-cloud.xyz to domain blocklists, and monitor for email traffic that may attempt to use the listed MX host. Given the Cloudflare edge, TLS inspection may be required to uncover payloads. Continuous re‑evaluation is advised in case the infrastructure is re‑activated or shifted to new IP addresses.