de[.]delaware-im[.]cc

Analysis of the domain de.delaware-im.cc indicates a confirmed credential-theft phishing operation active as of July 29, 2026. The domain was registered on June 12, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site is hosted on Cloudflare nameservers (cesar.ns.cloudflare.com and nataly.ns.cloudflare.com) and resolves to the IP address 188.114.96.3, which has been linked to prior phishing campaigns. At the time of assessment, the domain returns an HTTP 200 status, confirming active server responsiveness.

Detection metrics from VirusTotal show that 8 out of 91 security vendors flag de.delaware-im.cc as malicious, while the domain also appears on at least one security blocklist, specifically PhishDestroy. The specific brand or service being impersonated has not been conclusively identified through available metadata, and no phishing kit or page title data is currently present in the evidence. The absence of additional context regarding the targeted brand or scam subtype limits further classification beyond a generic credential-harvesting phishing site.

Defenders are advised to treat this domain as high-risk and implement blocking measures at the DNS or network level. Given the use of Cloudflare infrastructure, additional scrutiny of related domains sharing the same nameservers or IP range may be warranted. The domain remains active, and further monitoring is recommended to track any shifts in detection rates or hosting patterns.