detectiva[.]click

Analysis of the domain detectiva.click, created on February 27, 2026 and registered through Dynadot, LLC, shows that it is currently active and resolves to the IP address 188.114.96.3. The domain is served by Cloudflare nameservers amalia.ns.cloudflare.com and elliott.ns.cloudflare.com, indicating the use of a reputable CDN for traffic routing. VirusTotal records indicate the domain was scanned by 91 independent security vendors, with no detections reported at the time of the scan; however, the absence of detections does not constitute proof of safety and should be interpreted as a single data point in a broader risk assessment.

The site is listed on one public security blocklist and is actively blocked by the PhishDestroy feed, confirming that threat‑intelligence communities have identified it as malicious. No additional metadata such as SSL certificate details, HTTP response codes, page titles, or brand targeting information is presently available, leaving those aspects of the infrastructure unverified. Consequently, the primary evidence supporting a phishing classification consists of the domain’s recent creation, its association with known phishing blocklists, and its inclusion in a dedicated anti‑phishing feed.

Defenders should continue to monitor the domain for any changes in reputation, enforce blocklist rules in perimeter defenses, and consider adding the IP 188.114.96.3 to deny‑list policies. Further investigation, such as direct URL probing in a sandboxed environment, may reveal the specific payload or credential‑harvesting tactics employed, enabling more precise mitigation guidance.