phamton[.]com-n3[.]us

Analysis of the domain phamton.com-n3.us shows a recent registration (February 21, 2026) and resolution to the IP address 172.67.159.234, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain lacks an SSL/TLS certificate, indicating that any traffic would be unencrypted and that the site does not present a valid HTTPS identity. The host is currently offline, preventing live content inspection, but historical data indicate the domain has been flagged by multiple security vendors.

VirusTotal records show 15 of 93 scanners labeling the domain as malicious, a signal that at least some detection engines observed suspicious behavior associated with the host. Independent blocklist providers PhishDestroy and ScamSniffer have also added the domain to their watchlists, reinforcing the assessment of malicious intent. No public page title, brand target, or specific phishing kit information has been disclosed, so the exact impersonated service remains unknown.

The combination of a newly created domain, use of a shared Cloudflare IP, absence of TLS, and multiple independent detections suggests the site was likely employed for credential harvesting or other generic phishing operations before being taken offline. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same IP or similar Cloudflare‑hosted assets, and consider adding the domain to internal blocklists. Ongoing threat‑intel feeds should be consulted for any future activity tied to the IP address or related registrant patterns.