57365u[.]net

Analysis of 57365u.net indicates that the domain is actively used for phishing. The domain was registered on April 04 2019 through Name.com, Inc. and is currently resolved to the IPv4 address 103.226.153.55. Cloudflare serves as the authoritative DNS provider, with the nameservers daniella.ns.cloudflare.com and tate.ns.cloudflare.com. On VirusTotal the domain received detections from six of ninety‑one scanned security vendors, confirming that at least a minority of AV engines recognize malicious activity associated with the host. The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy filtering service, demonstrating that community‑driven defenses have already taken notice.

Publicly available intelligence does not reveal the site’s HTTP response code, TLS certificate details, page title, or any Safe Browsing verdict beyond the single blocklist entry. Consequently, the exact phishing payload, targeted brands, or credential‑capture mechanisms remain undefined. The lack of additional contextual data limits the ability to attribute the campaign to a specific threat actor or to assess the breadth of its victim population. Defenders should prioritize containment of 57365u.net at the network perimeter. Immediate actions include adding the domain and its resolved IP address (103.226.153.55) to DNS‑based deny lists, enforcing outbound traffic filtering to block HTTP/S requests to the host, and updating proxy or web‑gateway rules to reject traffic flagged by PhishDestroy.

Continuous monitoring of DNS query logs for recursive lookups to the Cloudflare nameservers can provide early warning of resurgence. Organizations that employ threat‑intel feeds should ingest the six VirusTotal detections and the blocklist entry to enrich existing detection rules. Because the domain’s infrastructure is hosted on a shared Cloudflare service, blocking the IP may impact legitimate tenants; therefore, domain‑level blocking is preferred where feasible.