x.securing-redirect.com — Cloudflare-Hosted Phishing Redirect

This domain, x.securing-redirect.com, is currently flagged as an active phishing redirector with high-risk classification. Registered on May 8, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain remains operational despite being blocked by at least one security vendor. Infrastructure analysis reveals the domain resolves to 172.67.158.3, a Cloudflare IP address located in Canada, and is served by Cloudflare nameservers adelaide.ns.cloudflare.com and ashton.ns.cloudflare.com. The use of Cloudflare infrastructure is consistent with threat actors leveraging content delivery networks to obscure origin servers and evade detection. The domain presents a 302 HTTP status code, indicating a temporary redirect, which is a common tactic in phishing campaigns to forward victims to malicious landing pages while maintaining a low profile. The SSL certificate, issued by Let's Encrypt, provides encryption but does not validate the legitimacy of the domain's intent. While four out of ninety-five security vendors on VirusTotal have flagged the domain, the majority have not yet detected it, suggesting either a targeted campaign or a recently deployed threat. Defenders should prioritize monitoring and blocking this domain, particularly in environments where redirect-based phishing is a known attack vector. The domain's registration details, combined with its Cloudflare hosting and redirect behavior, align with patterns observed in credential harvesting and malware distribution schemes. Given its active status and low trust score of 0/100, organizations are advised to treat this domain as malicious until further evidence suggests otherwise. Additional scrutiny of related subdomains or IP ranges associated with 172.67.158.3 may uncover broader campaign infrastructure.