mobile[.]logwindoww[.]top

Analysis of mobile.logwindoww.top indicates that the domain was registered through NiceNIC International Group Co., Limited on 2026-03-04 and delegated to Cloudflare name servers addilyn.ns.cloudflare.com and alfred.ns.cloudflare.com. The domain resolves to 104.21.21.176, an address owned by Cloudflare, Inc. (AS13335) located in the United States. No TLS certificate is presented, and an HTTP request returns a 404 Not Found page title, suggesting the site is currently unavailable.

VirusTotal scans have returned six positive detections out of ninety‑four submitted engines, and the domain is listed on one external blocklist. PhishDestroy has also flagged the host, confirming its classification as a generic phishing vector. The combination of recent creation, use of Cloudflare infrastructure, lack of encryption, and multiple vendor detections aligns with typical phishing staging practices.

Because the site is presently offline, threat actors may be rotating the payload or awaiting activation, leaving the current operational state uncertain. Defenders should continue to block the domain and the associated IP address at network perimeter and DNS filtering layers, add the host to internal reputation lists, and monitor for any re‑appearance of the domain or related sub‑domains on the same Cloudflare name servers. Ongoing observation of Cloudflare‑hosted IP ranges for similar patterns is recommended, as is periodic re‑query of VirusTotal and other reputation services to capture future detections.