cycleportal[.]network

The domain cycleportal.network was registered on February 21, 2026 through NameSilo, LLC and is currently active. DNS resolution points to IP address 104.21.64.1, which belongs to Cloudflare’s network (AS13335, United States). The hosting infrastructure is protected by Cloudflare services, as indicated by the presence of Cloudflare Browser Insights and HTTP/3 support. The TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming the use of a legitimate certificate chain.

An HTTP request to the root URL returns a 403 status code, and the page title displayed is "Nur einen Moment…", a phrase that does not reveal any legitimate branding. The site is classified as a brand‑impersonation scam targeting Cloudflare, and at least one security vendor out of ninety‑three on VirusTotal flagged the domain as malicious. Additional reputation data shows a Gridinsoft trust score of 0 out of 100, indicating a highly suspicious profile. The domain appears on a single security blocklist and has been blocked by PhishDestroy, reinforcing its malicious intent.

While the infrastructure appears legitimate due to Cloudflare’s involvement, the combination of a newly created domain, a generic 403 response, a non‑English title, and the low trust score suggests that the site is likely being used to deceive users by masquerading as an official Cloudflare service. Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, monitor outbound connections to the associated IP address for anomalous activity, and update internal threat intelligence feeds with the indicator set (domain, IP, nameservers, and certificate details). Because the content of the site beyond the title has not been publicly disclosed, further investigation—such as sandboxed URL retrieval and content analysis—should be prioritized to determine whether credential harvesting or additional payload delivery mechanisms are employed.