emiratespost[.]check0348[.]cfd

emiratespost.check0348.cfd was observed hosting a generic phishing page as of July 23 2026. The domain was registered through Global Domain Group LLC on 21 February 2026 and immediately pointed to the Cloudflare edge address 188.114.96.3, an IP owned by AS13335 (Cloudflare, Inc.) located in the United States. The authoritative name servers are amit.ns.cloudflare.com and candy.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. No TLS certificate is presented; the site serves HTTP only, which is consistent with the lack of an SSL certificate in the intelligence.

The HTTP response returned a page title of “Just a moment…”, but no further content details are available. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating an extremely low confidence rating. Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal records 12 detections out of 93 scanned vendors, reinforcing the malicious assessment. The domain is listed on one security blocklist and has been blocked by the PhishDestroy feed, after which the hosting provider took the site offline.

Because the site is already removed, immediate containment actions are limited to confirming that the domain is no longer reachable (e.g., DNS queries return NXDOMAIN) and ensuring that any inbound traffic to the IP address is denied at the network perimeter. Defensive teams should add the domain, its IP, and the associated Cloudflare name servers to local blocklists, monitor for any re‑registration attempts, and consider sharing the indicators with upstream threat‑intelligence feeds. Continuous observation of Cloudflare‑hosted IP ranges for similar fast‑flux patterns is recommended, as the infrastructure can be reused for future phishing campaigns.