codigo[.]finance

This domain, codigo.finance, is flagged as a high-risk phishing endpoint targeting financial services. Registered on February 21, 2026, through NameSilo, LLC, the domain currently resolves to 104.21.39.85, an IP address hosted on Cloudflare's infrastructure (AS13335). Analysis indicates the domain is actively leveraging Cloudflare nameservers (david.ns.cloudflare.com, eleanor.ns.cloudflare.com) and HTTP/3 technology, which may be used to obfuscate malicious traffic or evade detection. The domain is presently returning a 521 HTTP status code with the page title 'codigo.finance | 521: Web server is down,' suggesting either a temporary takedown, backend misconfiguration, or deliberate evasion tactic to avoid automated scanning. Infrastructure review reveals that codigo.finance appears on one security blocklist and is flagged by a single security vendor on VirusTotal, though the specific nature of the threat remains unverified beyond its classification as generic phishing. The SSL certificate, issued by Google Trust Services (WE1), is consistent with legitimate domains but does not preclude malicious use. The 301 HTTP redirect observed may indicate an attempt to funnel victims to an alternative malicious endpoint, though the destination remains unknown at this time. Defenders should prioritize this domain for blocking at the DNS and network layers, particularly in financial or corporate environments where credentials or sensitive data may be targeted. The use of Cloudflare infrastructure complicates traditional IP-based blocking, necessitating domain-level enforcement. Monitoring for outbound connections to 104.21.39.85 or related subdomains is recommended, as the domain may resume active phishing operations once backend issues are resolved. Given the domain's recent registration and active blocklist presence, assume malicious intent until further evidence suggests otherwise.