redheifergoy[.]com

redheifergoy.com was registered on March 11 2026 through NiceNIC International Group Co., Limited. The domain resolves to 172.67.137.189, an IP owned by AS13335 Cloudflare, Inc. in the United States. Traffic is served behind Cloudflare, with Cloudflare Browser Insights and HTTP/3 observed, and the TLS certificate is a Let’s Encrypt E8 certificate. The only visible page title returned before the site was taken offline is “Welcome to nginx!”, which is the default banner of an Nginx server and provides no insight into the hosted content.

VirusTotal records show that 3 of 94 security vendors have flagged the domain, indicating that at least a minority of scanners recognize malicious behavior. The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the suspicion of phishing use. The combination of recent registration, Cloudflare‑hosted infrastructure, a generic server banner, and multiple blocklist entries aligns with typical phishing‑hosting patterns.

However, the exact phishing payload, targeted brand, or lure type cannot be confirmed because the site content was not captured before takedown. Defenders should continue to block the domain at perimeter filters, add the IP address 172.67.137.189 to deny lists where appropriate, and monitor for any re‑registration or similar domains using the same registrar or Cloudflare configuration. Ongoing threat‑intel feeds should be consulted for updates, and any internal alerts that reference this domain should be investigated for potential compromise.