direktkauf[.]live

Analysis of the domain direktkauf.live, created on February 21, 2026 and currently taken offline, shows several indicators consistent with a generic phishing operation. The site resolved to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain is hosted behind Cloudflare’s edge network and uses Google Trust Services / WE1 for its TLS certificate, indicating a valid HTTPS endpoint despite the malicious intent. Technical fingerprints reveal a Node.js back‑end running the Express framework, and the service was delivering HTTP/3 traffic, a modern protocol often leveraged to evade legacy inspection tools.

The page title returned by the server was simply "Error", and the HTTP response code was 404, suggesting that the malicious content was either removed or deliberately hidden before takedown. VirusTotal scanned the domain and recorded three positive detections out of ninety‑three security vendors, providing independent confirmation of suspicious activity. Additionally, the domain appears on a single security blocklist and has been flagged by PhishDestroy, reinforcing the phishing classification. The registrar listed for the domain is NiceNIC International Group Co., Limited, a commonly used registrar for transient malicious sites.

Nameserver records point to collins.ns.cloudflare.com and rory.ns.cloudflare.com, both Cloudflare‑controlled resolvers, which further obscures the true origin of the host. While the offline status prevents direct observation of the payload, the combination of a recent registration date, Cloudflare‑based hosting, a valid SSL certificate, and multiple vendor detections constitutes a high confidence indicator of phishing intent. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat‑intelligence feeds, and monitor for any future re‑registration or related infrastructure reuse.