blindfoldfinance[.]xyz

Analysis indicates that blindfoldfinance.xyz is a phishing domain flagged by multiple security vendors and currently offline. The domain, registered on December 27, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, resolves to an IPv6 address (2606:4700:3030::6815:6d4) hosted on Cloudflare's network (AS13335, US). Nameservers leo.ns.cloudflare.com and phoenix.ns.cloudflare.com further confirm Cloudflare as the infrastructure provider. No SSL certificate was detected, which is atypical for legitimate financial or e-commerce sites and increases exposure to interception risks.

The page title 'Et øjeblik ...' suggests a Danish-language phishing attempt, though the exact target or brand impersonation remains unconfirmed due to the domain's offline status. AlienVault OTX lists the domain in three threat intelligence pulses, and Gridinsoft assigns a trust score of 0/100. Nine of 93 security vendors on VirusTotal flagged the domain as malicious, reinforcing its classification as a phishing threat. The domain appears on one security blocklist, and it was blocked by PhishDestroy prior to being taken offline.

Defenders should treat this domain as compromised and maintain blocklist entries. The absence of SSL, combined with Cloudflare hosting and a recent registration date, aligns with common phishing infrastructure patterns. While the domain is currently offline, monitoring for reactivation or related domains using similar naming conventions (e.g., 'blindfold' + financial terms) is recommended. No evidence of a specific phishing kit or payload is available, and further forensic analysis would require access to the original content or server logs.