max-wallconnecttesting-z1[.]com

Analysis of the domain max-wallconnecttesting-z1.com indicates active use in a banking‑phishing campaign prior to its takedown. The domain was registered on 22 December 2025 through MAT BAO CORPORATION and is hosted on Cloudflare infrastructure (AS13335) with the address 172.67.132.187, a server located in the United States. DNS resolution uses the Cloudflare authoritative nameservers duke.ns.cloudflare.com and novalee.ns.cloudflare.com. No TLS certificate is associated with the domain, confirming the absence of HTTPS encryption at the time of observation.

Google Safe Browsing classifies the site as a social‑engineering threat, and VirusTotal reports that 16 of 93 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of phishing activity. The domain appears on four independent blocklists, specifically PhishDestroy, Polkadot, Enkrypt, and Codeesura, all of which have recorded it as a banking‑phishing vector. Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of reputational confidence.

Current operational status is offline, preventing further direct probing, but the historical evidence confirms the domain’s role in credential‑theft attempts targeting financial services. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration attempts, and ensure that endpoint protection solutions are updated with the observed indicator set. While the exact phishing page content remains unverified, the convergence of registrar data, hosting details, multiple vendor detections, and blocklist listings provides sufficient confidence to treat max-wallconnecttesting-z1.com as a confirmed banking‑phishing asset.