ajayconnect[.]online

Analysis of ajayconnect.online shows it is actively serving HTTP content (status 200) and resolves to the Cloudflare edge address 104.21.63.84, associated with ASN 13335 (Cloudflare, Inc.) in the United States. The site presents the page title “openmediavault Workbench,” a reference not linked to any known legitimate service for the domain, indicating a likely deception layer. The domain was registered on September 01 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and uses Cloudflare name servers (aria.ns.cloudflare.com, cosmin.ns.cloudflare.com). SSL termination is provided by Google Trust Services under the WE1 certificate, a common configuration for abused Cloudflare‑hosted sites. Threat intelligence flags include a Gridinsoft trust score of 0 / 100, a single detection out of 91 security vendors on VirusTotal, and inclusion on one external blocklist. The site is currently listed as blocked by PhishDestroy, confirming its classification as a high‑risk phishing vector. While the exact credential‑harvesting mechanism has not been publicly observed, the combination of a generic page title, low trust score, and active blocking suggests a deliberate phishing campaign. Defenders should add ajayconnect.online to outbound filtering rules, monitor DNS queries for the domain, and consider sinkholing the associated IP range. Continuous re‑evaluation is recommended to detect any changes in content or additional malicious indicators.