protocol-user-finance[.]cc

Analysis of protocol-user-finance.cc, observed on July 24, 2026, indicates that the domain is currently offline but was previously identified as a generic phishing infrastructure. The domain was registered on September 25, 2025 through NiceNIC International Group Co., Limited and resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. Cloudflare’s DNS service is confirmed by the authoritative nameservers melnicoff.ns.cloudflare.com and naomi.ns.cloudflare.com, and the site employed HTTP/3 as part of its transport stack. The TLS certificate presented by the host is issued by Google Trust Services under the WE1 label, indicating a valid, publicly trusted certificate chain.

The only visible page title returned before the site was taken down reads "Website Created," providing no further insight into the content or targeted brand. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, suggesting that threat‑intel feeds have flagged it for malicious use. VirusTotal analysis shows that seven of ninety‑three scanning engines flagged the domain, reinforcing the suspicion of abuse. No additional evidence links the domain to a specific phishing kit, brand, or payload, and the limited public surface prevents confirmation of the exact scam mechanics.

Given the observed indicators—registrar information, Cloudflare hosting, a valid Google‑issued certificate, detection by multiple vendors, and blocklist inclusion—defenders should treat protocol-user-finance.cc as a high‑confidence phishing indicator. Recommended mitigations include adding the domain to outbound URL filtering rules, updating internal blocklists, monitoring DNS queries for the resolved IP, and employing sinkhole or passive DNS services to track any re‑use of the same infrastructure.