centrifuge-app[.]pro

Analysis of centrifuge-app.pro, created on February 21, 2026, shows a high‑risk generic phishing infrastructure that remains active as of the report date, July 24, 2026. The domain resolves to the IPv4 address 45.84.206.4, which is registered to AS47583 Hostinger International Limited and geolocated to Lithuania. Registration details list HOSTINGER operations, UAB as the registrar, and the authoritative name servers are ns1.dns-parking.com and ns2.dns-parking.com. The web server presents a valid Let's Encrypt certificate (R13) and responds with HTTP status 200, indicating a functional site.

Detected technologies include PHP, LiteSpeed, Hostinger hosting, and support for HTTP/3, consistent with a typical low‑cost hosting environment. Gridinsoft assigns a trust score of 0 out of 100, reflecting a severely untrusted reputation. VirusTotal analysis records four detections out of ninety‑three scanned engines, reinforcing the malicious classification. The domain is listed on seven security blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, Polkadot, and SEAL, demonstrating that multiple threat‑intelligence providers have identified it as malicious.

The page title returned by the server is "Centrifuge App," suggesting an attempt to impersonate a legitimate application, though no further content details are available. Evidence gaps include the absence of publicly shared payload samples, phishing lure specifics, or victim reports, leaving the exact phishing workflow uncertain. Defenders should add 45.84.206.4 to network deny lists, block the domain and its associated name servers at DNS filtering layers, and ensure endpoint security solutions are updated to recognize the four VirusTotal detections. Continuous monitoring of blocklist updates and periodic re‑scanning of the domain are recommended to capture any changes in the threat posture.