detifuna[.]cc

detifuna.cc is currently classified as a high‑risk generic phishing site. The domain was registered on February 21 2026 through NiceNIC International Group Co., Limited and is actively resolving to the IP address 188.114.97.3. The page title returned by the server is “www.www.detifuna.cc”, which matches the domain string and provides no additional context about the intended victim or lure.

Infrastructure analysis shows the domain is fronted by Cloudflare, as indicated by the authoritative nameservers alexis.ns.cloudflare.com and brianna.ns.cloudflare.com. The service is delivering content over HTTP/3 and responds with an HTTP 302 redirect, a common technique for funneling visitors to a secondary landing page. The underlying IP is located in the Cloudflare network in California, United States, and the same address is shared by other Cloudflare‑protected sites, limiting direct attribution beyond the hosting provider.

Threat intelligence sources corroborate the malicious classification. The domain appears in a single AlienVault OTX pulse, and VirusTotal records ten detections out of ninety‑five scanned scanners. Gridinsoft assigns a trust score of zero, and the domain is listed on at least one public blocklist, including PhishDestroy. These signals collectively raise the confidence that the site is being used for phishing operations, despite the limited number of external detections.

Defenders should incorporate the domain into automated blocking rules and monitor DNS queries for lookups to the Cloudflare nameservers associated with this domain. Because the site relies on Cloudflare’s infrastructure, traditional IP‑based blocking may impact legitimate services that share the same edge network; therefore, domain‑level controls are recommended. Continuous re‑evaluation is advised, as additional detections or changes in the page title could alter the risk posture.