comerciobay[.]com

On 24 July 2026, the domain comerciobay.com was observed as an offline phishing infrastructure. The domain was registered on 21 February 2026 and resolves to the IP address 172.67.164.107, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The SSL certificate presented for the host is identified as WE1, indicating use of a standard Cloudflare‑issued certificate. VirusTotal analysis shows that one of ninety‑three participating security vendors flagged the domain, confirming that it has been detected by at least one reputable scanning engine. The domain appears on a single public blocklist and is specifically listed by the PhishDestroy service, reinforcing its classification as malicious.

HTTP probing returned a 522 “Connection timed out” status, and the page title reported by the probe is “comerciobay.com | 522: Connection timed out”, which suggests that the service is currently unreachable but was previously active. No additional intelligence such as Safe Browsing, OTX, or brand targeting is available in the current dataset. The available evidence points to a short‑lived phishing campaign that leveraged Cloudflare’s CDN to obscure the true origin of the malicious server. The limited detection footprint—only one vendor flag and a single blocklist entry—may indicate that the campaign was either low‑volume or recently taken down.

Because the domain is presently offline, active mitigation is limited to preemptive blocking. Security teams should add 172.67.164.107 to their deny lists, enforce DNS‑based filtering for comerciobay.com, and monitor Cloudflare‑owned address ranges for similar rapid‑turnover domains. Continuous re‑scanning on VirusTotal and periodic checks against blocklist feeds are recommended to capture any re‑use of the infrastructure.