proactive-monitor[.]cfd

Analysis as of July 25, 2026 indicates that the domain proactive-monitor.cfd is associated with a generic phishing campaign. The domain was registered on October 28, 2025 through NiceNIC International Group Co., Limited and currently resolves to 172.67.216.161, an address owned by AS13335 Cloudflare, Inc. located in the United States. DNS resolution uses the Cloudflare authoritative nameservers dana.ns.cloudflare.com and ethan.ns.cloudflare.com. An HTTP request to the host returns a 404 Not Found page title, and no TLS certificate is presented, confirming the absence of HTTPS encryption.

The domain appears on a single security blocklist and is listed as blocked by the PhishDestroy service. On VirusTotal, three of ninety‑five scanners have flagged the domain, providing additional corroboration of malicious activity. Gridinsoft’s trust scoring system assigns a score of 0 out of 100, indicating extreme lack of trust. The site is presently taken offline, which limits immediate threat exposure but does not remove the underlying infrastructure.

Defenders should continue to monitor the IP address 172.67.216.161 for any resurgence, enforce outbound filtering for the domain, and ensure that any email or web traffic that references proactive-monitor.cfd is blocked at the perimeter. Because the site served only a 404 response and no SSL certificate, the exact phishing payload or targeted brand remains unknown; further investigation would be required to capture any archived content or associated phishing kits. Until such artifacts are recovered, the recommendation is to keep the domain on blocklists, maintain vigilance on Cloudflare‑hosted IP ranges, and update detection signatures based on the observed blocklist and VirusTotal flags.