cleanusdt[.]space

Analysis of cleanusdt.space indicates the domain was registered on July 05, 2026 through OwnRegistrar, Inc. The domain is currently active and resolves to the IP address 188.114.97.3, which is hosted on Cloudflare nameservers charles.ns.cloudflare.com and harleigh.ns.cloudflare.com. The site has been classified as a generic phishing site and appears on one security blocklist; it is also listed as blocked by PhishDestroy. A VirusTotal scan involving 95 AV engines returned no detections, but the absence of detections does not constitute a safety assurance. No additional intelligence such as Safe Browsing status, Open Threat Exchange records, SSL certificate details, HTTP response codes, trust‑score metrics, or page‑title information is available at this time. The lack of such data limits the ability to fully characterize the payload or the phishing kit used. Defenders should treat the domain as malicious based on its classification and blocklisting status. Recommended actions include adding cleanusdt.space and its resolved IP 188.114.97.3 to network‑level deny lists, updating URL filtering policies, and monitoring for outbound connections to the IP. Continuous re‑inspection of the domain for new indicators, such as changes in DNS records, the emergence of detection signatures, or the appearance of page‑title or SSL data, is advised. Incident response teams should also correlate any internal logs that reference this domain with potential credential‑theft attempts.