canor[.]cfd

This domain, canor.cfd, is flagged as a high-risk generic phishing threat and remains active as of July 12, 2026. It was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar often associated with low-effort or malicious domain registrations. The domain resolves to IP address 188.114.97.3, which is hosted in the United States by Cloudflare, Inc. (AS13335), and uses Cloudflare nameservers (randall.ns.cloudflare.com and teresa.ns.cloudflare.com). Infrastructure analysis reveals the domain employs Cloudflare's CDN and security services, including HTTP/3 and Browser Insights, and presents an SSL certificate from Google Trust Services. The site returns an HTTP 403 status code and displays the page title Just a moment..., which is typical of Cloudflare's challenge page, suggesting the actual malicious content may be gated behind Cloudflare's protection to evade automated analysis. VirusTotal data indicates 6 out of 93 security vendors flag this domain as malicious, and it appears on at least one security blocklist (PhishDestroy). AlienVault OTX has recorded it in one threat intelligence pulse. The Gridinsoft trust score is 0/100, reinforcing the high-risk assessment. What is uncertain is the specific brand or service this domain targets, as no brand name is identified in the available data; the classification as generic phishing indicates no known impersonation of a particular entity. Defenders should monitor for any outbound connections to this domain from internal hosts, block it at the DNS or proxy level, and investigate any credentials or data that may have been submitted if users visited the site. Given the use of Cloudflare for obfuscation, further analysis may require inspecting the site's underlying content through alternative methods, such as headless browser analysis or reviewing historical snapshots.