emiratespost[.]pkzt[.]top

Analysis of emiratespost.pkzt.top shows a newly registered domain (created 21 Feb 2026) that is currently offline but was previously flagged by multiple security services. The domain resolves to 188.114.96.3, an address owned by Cloudflare (AS13335) located in the United States. DNS resolution uses Cloudflare’s authoritative name servers izabella.ns.cloudflare.com and jake.ns.cloudflare.com, indicating the attacker leveraged a reputable CDN to hide infrastructure. No TLS certificate is deployed, so the site would have presented an unencrypted HTTP connection.

The only observable HTTP response is the default Nginx landing page with the title “Welcome to nginx!”, suggesting the attacker either left the server in its default state or used it as a placeholder. VirusTotal records show 16 of 93 scanning engines flagging the domain, and Google Safe Browsing classifies it as social‑engineering, confirming a phishing intent. The domain appears on one external blocklist and is specifically listed by PhishDestroy, reinforcing its malicious reputation. The registrar is Dominet (HK) Limited, a commonly used registrar for disposable or malicious domains.

Because the site is offline, content analysis is not possible; the exact brand or credential‑harvesting page remains unknown. Defenders should continue to block the IP address 188.114.96.3 at network perimeter, add emiratespost.pkzt.top to URL filtering and DNS sinkhole lists, and monitor for any re‑activation of the domain or related sub‑domains. Ongoing threat‑intelligence feeds should be queried for new detections, and any future TLS or content changes should be re‑examined to assess whether the actor has deployed a credential‑stealing front‑end.