email12[.]datanium[.]top

email12.datanium.top was registered on May 05, 2026 through NameSilo, LLC. The domain resolves to the Cloudflare‑owned IP address 188.114.96.3, which places the infrastructure in California. Authoritative nameservers naya.ns.cloudflare.com and cesar.ns.cloudflare.com confirm that the site is fronted by Cloudflare’s CDN and DNS services. The site presents a valid Let’s Encrypt certificate (E8) that was issued shortly after registration, indicating the operators have taken steps to obtain HTTPS encryption.

Multiple security platforms have flagged the domain. VirusTotal records show that four of ninety‑five scanning engines have identified malicious behavior, a modest but notable detection rate. Gridinsoft assigns a trust score of zero out of one hundred, and the domain is listed on a single public blocklist. PhishDestroy actively blocks the site, and an HTTP request returns a 403 response, suggesting that the content is intentionally hidden or that the site is being shielded after detection.

The available evidence points to a classic generic phishing operation. The combination of a newly‑created domain, Cloudflare front‑end, a free TLS certificate, and low trust scores is consistent with infrastructure used to host credential‑harvesting pages. However, the exact phishing payload, targeted brands, or lure mechanisms have not been captured in public intelligence, leaving the content of the hosted page uncertain. The domain’s high‑risk rating aligns with its active status and the presence of detection markers.

Defenders should add 188.114.96.3 and email12.datanium.top to outbound filtering and DNS sinkhole rules. Continuous monitoring of Cloudflare‑associated IP ranges for similar newly‑registered domains is advised. Given the active 403 response, any attempt to retrieve the page should be performed in a controlled sandbox environment to confirm the phishing vector. Immediate blocking will reduce exposure while further forensic analysis proceeds.