dflow-trade[.]com

Analysis was performed on dflow-trade.com as of 23 July 2026. The domain was registered on 29 June 2026 through the registrar UnstoppableUS1 LLC and uses the public DNS service provided by ns1.unstoppabledomains.com and ns2.unstoppabledomains.com. DNS resolution points to the single IPv4 address 45.9.117.57, which remains reachable and serves HTTP content at the time of analysis. The domain appears on one known security blocklist and has been added to the PhishDestroy blocklist, indicating that at least one industry-wide feed is actively filtering traffic to it.

VirusTotal records show that the domain was scanned by 91 anti-malware engines; none of the engines returned a positive detection, but the absence of a detection does not constitute a safety guarantee. No additional metadata such as ASN, country, SSL certificate details, or HTTP status codes were provided in the intelligence feed, so the hosting environment and transport security posture cannot be fully assessed. The current classification is "generic phishing," but the specific brand or service being spoofed has not been disclosed in the available data. Consequently, the exact lure technique and credential-harvesting payload remain unknown.

Defenders should continue to block dflow-trade.com at perimeter firewalls, DNS resolvers, and proxy devices, and they should monitor outbound connections to the IP address 45.9.117.57 for any anomalous activity. Adding the domain to internal blocklists and updating endpoint URL filtering policies is recommended. Because the domain is still active, ongoing reconnaissance is advised: periodic re-scans with VirusTotal or similar multi-engine services, retrieval of the HTTP response headers, and verification of any TLS certificates that may be presented in the future. Organizations that employ user awareness training should include dflow-trade.com in phishing simulation libraries to reinforce detection of newly emerging fraudulent sites.