sherlokpoiskbot[.]info

Analysis of sherlokpoiskbot.info shows a domain registered on July 29, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and hosted on Cloudflare infrastructure, as indicated by the authoritative nameservers june.ns.cloudflare.com and vicky.ns.cloudflare.com. DNS resolution points to the IP address 172.67.132.172, a Cloudflare‑owned address that provides no direct insight into the underlying server. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service, confirming that at least one defensive platform has identified it as malicious.

VirusTotal reports that the domain was scanned by 91 antivirus and URL‑reputation vendors, with none flagging it as malicious; however, the absence of detections does not constitute evidence of safety, especially given the recent creation date and active blocklist status. The threat type is catalogued as generic phishing, and the current operational status is listed as active, with the risk level marked as under investigation.

Defenders should treat the domain as hostile: inbound traffic to the domain should be denied at firewall or proxy layers, DNS queries can be filtered, and any alerts referencing the IP 172.67.132.172 or the associated Cloudflare nameservers should be investigated for potential abuse. Continuous monitoring of blocklist updates and threat‑intel feeds is recommended to capture any future re‑classification or additional indicators of compromise associated with this domain.