shade3[.]vc

The domain shade3.vc was registered on 23 November 2025 through NameCheap, Inc. and is currently marked as offline. VirusTotal records show that five of ninety‑five scanning engines flagged the domain as malicious, indicating that at least a subset of security products identified suspicious behavior. DNS resolution returns the IPv6 address 2606:4700:3035::ac43:de01, which belongs to AS13335 operated by Cloudflare, Inc., a common infrastructure used by phishing operators to hide origin. The domain appears on a single public security blocklist and has been explicitly blocked by the PhishDestroy service.

Reputation scoring from Gridinsoft assigns a trust value of 0 out of 100, reinforcing the malicious assessment. No TLS certificate is present; the site served only HTTP, which further reduces credibility and suggests a hastily deployed payload. The authoritative nameservers are kianchau.ns.cloudflare.com and leia.ns.cloudflare.com, both hosted by Cloudflare, matching the observed IP hosting. The page title returned by the server is “Shade³”, but no additional content has been captured, and the site is no longer reachable, limiting the ability to confirm the exact phishing layout or credential‑harvesting mechanisms.

The intelligence indicates the campaign is a brand‑impersonation attempt targeting the brand “across”, as noted in the “Brand target” field. Because the site is offline, active verification of the phishing flow is not possible, and the specific techniques used remain uncertain. Defenders should continue to block the IPv6 address and associated Cloudflare nameservers, add shade3.vc to local deny lists, and monitor for re‑registration or similar domains using the same registrar and naming patterns. Ongoing vigilance is recommended, including periodic re‑scanning of the domain should it become active again, and correlation with any incidents reporting credential theft related to the “across” brand.