redirect-18290[.]com

On July 29, 2026, the domain redirect-18290.com was flagged as part of an active generic phishing campaign and assigned an elevated risk level. The domain was created on June 08, 2026 and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolution points to the IP address 172.67.157.171, which is owned by the Cloudflare network, suggesting the operators are leveraging a reputable content‑delivery service to hide the true hosting environment. The domain is listed on three independent security blocklists and has been explicitly blocked by three commercial filtering solutions: PhishDestroy, MetaMask, and SEAL, reinforcing its malicious reputation.

VirusTotal reports six detections out of ninety‑one scanners, indicating that a subset of security engines have identified the site as hostile, which aligns with the elevated risk rating. No public page title, SSL certificate details, or HTTP response data have been published, so the precise phishing lure, targeted brand, or kit employed remains unknown. This lack of content‑level evidence creates uncertainty about the specific credential‑harvesting technique used.

Defenders should add redirect-18290.com to URL filtering and DNS sinkhole policies, block outbound traffic to the associated Cloudflare IP range, and incorporate the domain into automated threat‑intel feeds. Continuous re‑assessment on VirusTotal and regular monitoring of blocklist updates are advised to capture any shift in detection posture. Organizations are also encouraged to reinforce email gateway controls, enforce multi‑factor authentication, and conduct user awareness training to mitigate the risk of credential theft attempts that may leverage this infrastructure.