98734afs5[.]cfd

Analysis indicates that the domain 98734afs5.cfd was registered through Dynadot LLC on 27 October 2025 and is currently offline. The authoritative nameservers are harvey.ns.cloudflare.com and rosa.ns.cloudflare.com, placing the domain behind Cloudflare’s network (ASN 13335). DNS resolution points to IP address 188.114.97.3, which is located in the United States and belongs to Cloudflare, Inc. No TLS certificate was observed, meaning the site served only HTTP content. The sole visible page title returned “Coming Soon,” providing no indication of a legitimate service. Reputation services assign a trust score of 1 out of 100 on Scamadviser, reflecting extreme suspicion.

Threat intelligence sources have recorded the domain in a single AlienVault OTX pulse and on one public security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reports that 12 of 95 scanned security vendors flagged the domain as malicious. The limited detection footprint suggests the site was short‑lived or rapidly taken down, but the presence of multiple vendor detections confirms malicious intent consistent with a generic phishing campaign. Uncertainty remains regarding the exact phishing payload, target brand, or compromised credentials, as no further content analysis is available beyond the generic page title. Defenders should continue to monitor DNS queries for 188.114.97.3 and enforce blocklisting of the domain across perimeter and endpoint security solutions.

Given the Cloudflare hosting, any future re‑use of the same IP or nameserver pair should be treated with heightened scrutiny. Updating URL filtering policies to include the domain and its associated IP, as well as leveraging threat intel feeds that reference the observed OTX pulse and blocklist entry, will reduce the risk of inadvertent exposure. Organizations that rely on the Scamadviser trust score or similar reputation metrics should consider the score of 1/100 as a strong indicator of malicious activity.