toeiwealth-invest[.]cfd

The domain toeiwealth-invest.cfd has been identified as an active phishing infrastructure specifically designed for brand impersonation. Analysis confirms the domain is targeting Cloudflare, a widely recognized content delivery and security provider, with the intent to deceive users into disclosing sensitive credentials or installing malicious payloads. The site remains operational and unmitigated as of the latest verification. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Porkbun LLC, a registrar commonly exploited for low-cost domain acquisitions. It currently resolves to the IP address 188.114.97.3, which has been associated with prior malicious activity. The domain appears on four distinct security blocklists, including MetaMask, SEAL, PhishDestroy, and InversionDNS, indicating cross-industry recognition of its threat status. VirusTotal reports that 11 out of 95 security vendors have flagged toeiwealth-invest.cfd as malicious, with Google Safe Browsing categorizing it under SOCIAL_ENGINEERING. The page title, 'Suspected phishing site | Cloudflare,' further corroborates the intent to mimic legitimate Cloudflare security warnings. The risk level for this domain is assessed as high due to its active status, brand impersonation tactics, and confirmed presence on multiple threat intelligence feeds. Organizations and end users are advised to implement immediate blocking measures at the DNS and network perimeter levels. Security teams should monitor for any connections to 188.114.97.3 or references to toeiwealth-invest.cfd in logs, particularly those related to authentication attempts or browser-based interactions. Users who may have visited the site should be instructed to reset credentials for any accounts accessed during the exposure window and to scan affected systems for unauthorized activity.