protect[.]nsfwverification[.]icu

The domain protect.nsfwverification.icu was registered on February 21, 2026 and, as of the report date July 23, 2026, is taken offline. DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated in the United States. The domain has been identified as a brand‑impersonation site targeting Telegram, with the page title observed as "LeakHer," indicating an intent to harvest credentials or personal data related to the messaging service. Infrastructure analysis shows that the domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy filtering service, suggesting that at least one reputable anti‑phishing feed has flagged it.

VirusTotal analysis reports that 10 out of 93 scanning engines flagged the domain as malicious, reinforcing the suspicion of a phishing campaign despite the relatively low detection count. The SSL certificate associated with the host is identified as "WE1," which does not correspond to a recognized certificate authority, further reducing trust. Gridinsoft’s trust scoring system assigns a score of 0 out of 100, indicating an extremely low confidence rating for the site’s legitimacy.

No additional data from Safe Browsing, Open Threat Exchange, or registrar records are available, and the actual page content has not been examined, leaving the precise payload and user‑interaction mechanisms uncertain. Defenders should continue to block protect.nsfwverification.icu at network perimeter devices, ingest the associated IP 188.114.96.3 into threat feeds, and monitor Cloudflare‑owned address ranges for any resurgence of similar brand‑impersonation activity. Continuous observation of VirusTotal and other sandbox services is recommended to capture any future re‑hosting attempts or changes in detection patterns.