cat500[.]click

This domain, cat500.click, was registered on March 23, 2026, through Sav.com, LLC, and remains active as of July 12, 2026. Analysis indicates it is currently resolving to the IP address 188.114.96.3, which is hosted by Cloudflare in Canada. The domain is configured with Cloudflare nameservers—shane.ns.cloudflare.com and zita.ns.cloudflare.com—and uses a Let's Encrypt SSL certificate with the identifier E8. The HTTP response code is 403, and the page title displayed is 'Just a moment...', a common indicator of Cloudflare's interstitial challenge or proxy behavior. Infrastructure analysis reveals the use of Cloudflare Browser Insights and HTTP/3, suggesting the operators are leveraging Cloudflare's full proxy stack to obscure backend hosting and evade detection. The domain has been flagged by three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, and is classified as a generic phishing threat. A single security vendor on VirusTotal has detected this domain as malicious, though broader consensus is limited at this time. The exact target of this phishing campaign remains uncertain. The domain name—cat500.click—does not directly reference a specific brand or service, and no phishing kit or credential-harvesting payload has been observed in public reporting. However, the use of Cloudflare's infrastructure, combined with a 403 response, suggests the site may be selectively serving malicious content to targeted visitors while blocking automated crawlers and security scanners. Defenders should treat this domain as high-risk due to its active status, Cloudflare proxy configuration, and presence on multiple blocklists. Network-level blocking or DNS filtering is recommended, particularly for organizations where brand impersonation or credential theft poses a significant risk. Monitoring for changes in HTTP status codes or page content may provide further insight into the campaign's evolution.