deltaprime-app[.]xyz

Analysis indicates that the domain deltaprime-app.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The domain resolves to 104.21.75.210, an address owned by Cloudflare, Inc. (AS13335) located in the United States. DNS is served by the Cloudflare authoritative name servers cartman.ns.cloudflare.com and jessica.ns.cloudflare.com. The site employs Cloudflare Browser Insights, Cloudflare edge services, and HTTP/3, confirming the use of Cloudflare’s performance and security platform. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, indicating a valid, publicly trusted certificate chain.

Reputation data show the domain appears on one security blocklist and is actively blocked by PhishDestroy. The Gridinsoft trust score is 0 out of 100, suggesting a maximal risk rating from that vendor. VirusTotal has recorded detections from five of ninety‑three scanned engines, reinforcing the malicious assessment. The page title returned by the live request is “Just a moment…”, a generic placeholder often associated with cloud‑based challenge pages rather than a legitimate brand landing page. The combination of a recently created domain, low trust score, presence on a blocklist, and multiple vendor detections aligns with the classification of a generic phishing infrastructure.

No additional evidence about the targeted brand, phishing kit, or specific payload is available from the current dataset. Consequently, the precise lure and victim profile remain uncertain. Defenders should add deltaprime-app.xyz to inbound and outbound filtering rules, monitor DNS queries for the associated Cloudflare IP range, and enforce blocklist updates that include the domain. Given the active blocklist entry and the low trust score, quarantine or deny any traffic to the domain. Continuous re‑assessment is advised in case new intelligence, such as additional vendor detections or content analysis, becomes available.