v3-pokladot[.]cc

Analysis of v3-pokladot.cc as of July 23 2026 indicates that the domain is associated with a high‑risk generic phishing operation. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to IP address 104.21.10.32, which belongs to Cloudflare’s network (AS13335) located in the United States. The site is served behind Cloudflare, as reflected by the detected technologies Cloudflare and HTTP/3, and uses a Cloudflare‑issued TLS certificate issued by SSL Corporation / Cloudflare TLS Issuing ECC CA 3. HTTP requests return a 403 status code and the page title presented by the server is “Suspected phishing site | Cloudflare”.

The domain appears on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating cross‑provider consensus on its malicious nature. VirusTotal analysis shows that 14 of 93 scanning engines flagged the domain, reinforcing the suspicion. Gridinsoft assigned a trust score of 0 out of 100, indicating extreme lack of trustworthiness. Nameserver configuration uses terry.ns.cloudflare.com and ximena.ns.cloudflare.com, consistent with the Cloudflare front‑end.

The current operational status is “offline”, but historical evidence suggests the domain was actively used for phishing prior to takedown. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms employed, as the page content was not captured beyond the title. Defenders should enforce network‑level blocking of the IP 104.21.10.32 and add v3-pokladot.cc to URL filtering lists, monitor for any re‑registration attempts, and continue to reference the four blocklists for indicator updates. Given the low trust score and multiple vendor detections, a precautionary block is justified while further forensic investigation is pursued.