prufendaten-de[.]click

This domain, prufendaten-de.click, is identified as a phishing site designed to impersonate a Cloudflare security checkpoint under the pretext of verifying user access. The page displays a deceptive 'Just a moment...' loading screen, a common tactic to mimic legitimate security challenges while harvesting credentials or deploying malicious payloads. Analysis indicates this is not a generic phishing attempt but a targeted impersonation of Cloudflare's verification system, likely intended to exploit user trust in security prompts to bypass multi-factor authentication or extract sensitive session tokens. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.85.167, which is part of a network range commonly used for content delivery and proxy services. The domain is flagged by 4 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100, and appears on one security blocklist. Detection technologies indicate the use of Cloudflare infrastructure and HTTP/3, suggesting the attackers may be leveraging legitimate services to obfuscate malicious activity and evade detection. As of the latest assessment, prufendaten-de.click has been taken offline, though the infrastructure remains a potential risk for future campaigns. Organizations and users are advised to block the domain and its resolving IP at the network level, monitor for similar impersonation tactics involving security checkpoints, and implement strict validation protocols for any unexpected verification prompts. Security teams should prioritize reviewing logs for interactions with 104.21.85.167 and domains registered through Global Domain Group LLC, particularly those created in early 2026, to identify potential compromise indicators.