fanta-radiohead[.]com

fanta-radiohead.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited. DNS resolution points to the Cloudflare‑owned address 172.67.145.109, hosted in the United States under ASN 13335. The domain is served by the Cloudflare nameservers hal.ns.cloudflare.com and mona.ns.cloudflare.com and does not present an SSL/TLS certificate, indicating that HTTPS was not enabled at the time of capture. The landing page title observed during the brief availability window reads “Crypto Loan with Nexo | Get Funds And Keep Your Crypto,” suggesting a lure that pretends to offer crypto‑backed financing.

The site was taken offline before the investigation concluded, but archival records show that it appeared on three public security blocklists and was explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis returned 16 positive detections out of 93 scanners, reinforcing the malicious classification. No additional intelligence such as OTX tags, Safe Browsing verdicts, or threat‑actor identifiers were available.

The absence of HTTPS and the rapid takedown limit the ability to collect deeper artefacts, leaving the exact phishing kit and victim‑targeting methodology unknown. Defenders should add 172.67.145.109 to network‑level deny lists, enforce DNS filtering for fanta-radiohead.com, and monitor for any re‑registration of the domain or similar aliases that reuse the same Cloudflare infrastructure. Continuous threat‑intel feeds should be consulted for new indicators that may emerge if the operators resurrect the campaign under a different domain.