salamoneq[.]xyz

Analysis indicates that salamoneq.xyz is an active high‑risk domain created on 5 April 2026. The domain resolves to 104.21.35.110, a Cloudflare edge node located in Canada, and is served through Cloudflare’s DNS (lynn.ns.cloudflare.com, walk.ns.cloudflare.com). The site presents a TLS certificate issued by Let’s Encrypt (E8) and returns HTTP status code 530, suggesting an abnormal server response. Reputation data shows a Gridinsoft trust score of 0 / 100 and that 7 of 91 VirusTotal scanners have flagged the domain. It appears on three public blocklists and is specifically listed by PhishDestroy, MetaMask, and SEAL. The page title “Salamoneq | Portfolio” and the classification as an investment‑scam phishing site imply that the operator is attempting to lure victims into fraudulent investment schemes, although the exact victim‑facing content has not been publicly examined. Registration was performed via OVH, SAS, a common registrar for disposable infrastructure. Defenders should block the domain at network perimeter, monitor DNS queries for the associated Cloudflare nameservers, and enforce TLS inspection to detect the 530 response. Continuous threat‑intel feeds should be consulted for any updates, and any observed traffic to the IP should be investigated for potential credential or financial data exfiltration.