node07[.]com

node07.com is currently active and observed delivering a generic phishing payload identified by the page title “usdt”. The domain was registered on 21 February 2026 through NameCheap, Inc. and is protected by a Google Trust Services / WE1 SSL certificate, indicating a valid TLS certificate issued by a trusted root. DNS resolution points to Cloudflare’s network (AS13335) at 172.67.172.19, with authoritative nameservers hugh.ns.cloudflare.com and ophelia.ns.cloudflare.com. The site returns an HTTP 302 status, suggesting a redirection before serving content, and leverages front‑end technologies including Vue.js, Unpkg, Cloudflare Browser Insights and HTTP/3, all typical of modern web‑hosting stacks. Threat intelligence shows the domain appears on one security blocklist and is explicitly listed by PhishDestroy.

VirusTotal analysis reports a single detection out of 93 scanning engines, confirming at least one security vendor flags the site as malicious. The MX records include two entries of equal priority (10) pointing to eforward2.registrar‑servers.com, which is consistent with the registrar’s default mail configuration and does not provide additional malicious indicators. The combination of recent registration, use of a reputable SSL certificate, Cloudflare edge hosting, and a simple redirect chain is consistent with a fast‑flux style phishing deployment that aims to evade static URL filters while presenting a seemingly legitimate HTTPS endpoint. The page title “usdt” suggests the campaign may be targeting users of stable‑coin services, although the exact content and credential‑capture mechanisms have not been publicly disclosed.

Defenders should treat node07.com as a high‑risk indicator. Immediate actions include adding the domain to DNS‑based blocklists, updating web‑proxy and secure web‑gateway policies to deny connections, and configuring email security gateways to reject messages referencing the domain.