colnbase-accountserve[.]setting-accountcolnbase[.]handsonline[.]net

The domain colnbase-accountserve.setting-accountcolnbase.handsonline.net was observed in a credential phishing campaign targeting users of the Imgflip service, as indicated by the page title “Imgflip - Create and Share Awesome Images”. The domain was registered on February 21, 2026 through Cosmotown, Inc. and is served by the private‑rack name servers ns1.private-rack.com, ns2.private-rack.com, ns3.private-rack.com, and ns4.private-rack.com. No TLS certificate is present, and the site resolves to the Cloudflare edge address 104.16.40.101, which is announced by AS13335 in the United States. Google Safe Browsing classifies the host as a social‑engineering threat, and the domain appears on a single external blocklist, where it is also listed by PhishDestroy.

VirusTotal analysis shows that nine out of ninety‑three scanning engines flagged the host, reinforcing the malicious classification. The infrastructure indicates a typical phishing staging pattern: a newly created domain, hosted behind a reputable CDN, and lacking HTTPS, which reduces trust signals for browsers and security tools. The current status is offline, limiting immediate observation of the payload, but the historical evidence suggests that the site was used to harvest credentials by masquerading as an Imgflip login page.

Uncertainty remains regarding the exact content delivered before takedown, as no page capture is available. Defenders should block the domain and its associated IP address at perimeter and DNS layers, monitor for traffic to the private‑rack name servers, and update detection rules to flag any future domains registered by Cosmotown, Inc. that resolve to the same Cloudflare ASN. Continuous review of threat‑intel feeds for similar brand‑impersonation patterns is recommended.