datahaven-ai[.]com

The domain datahaven-ai.com was observed hosting a generic phishing page that uses the page title “Nur einen Moment…” and is classified as a brand impersonation attempt. The site was registered on November 23 2025 through NiceNIC International Group Co., Limited and points to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. No TLS certificate is presented, indicating the site was served over plain HTTP. DNS resolution uses Cloudflare name servers lewis.ns.cloudflare.com and rosa.ns.cloudflare.com.

Threat intelligence shows three of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single security blocklist. Gridinsoft assigned a trust score of zero out of one hundred, and PhishDestroy has already blocked the host. The site was taken offline at the time of this report, and no further HTTP response details are available. Because the domain is newly created (less than eight months old) and lacks a valid certificate, the infrastructure is consistent with typical phishing infrastructure that relies on fast‑provisioned cloud hosting.

Defenders should continue to block the domain at perimeter firewalls, proxy filters, and DNS sinks, and add the IP address 188.114.97.3 to deny‑lists where appropriate. Monitoring for any re‑registration or similar domains that resolve to the same Cloudflare ASN is advisable. Since the page title is the only visible content, analysts should treat any emails referencing “Nur einen Moment…” or the datahaven‑ai brand as suspicious. No additional indicators such as payload hashes or command‑and‑control URLs have been disclosed, so further investigation should focus on correlation with user‑reported phishing attempts and the limited blocklist entry.