harmonybitspire-ki[.]net

On 12 March 2026 the domain harmonybitspire-ki.net was registered through PDR Ltd. d/b/a PublicDomainRegistry.com. The authoritative nameservers listed are kayleigh.ns.cloudflare.com and terin.ns.cloudflare.com, indicating that the domain is using Cloudflare’s DNS services. DNS resolution points to IP address 172.67.193.99, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The site served an SSL certificate issued by Let’s Encrypt (E8) and announced the use of HTTP/3 and HSTS, consistent with Cloudflare‑hosted infrastructure. The page title returned by the server reads "Suspected phishing site | Cloudflare," matching the declared brand impersonation target of Cloudflare. Automated scans on VirusTotal recorded five positive detections out of ninety‑four vendors, and Google Safe Browsing flagged the URL for social engineering.

Additional reputation services have placed the domain on three known blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious classification. The overall risk rating has been set to high, and the site has since been taken offline. Available evidence confirms that the domain was actively used for brand impersonation of Cloudflare, leveraging legitimate Cloudflare DNS and CDN services to increase credibility. The presence of a legitimate Let’s Encrypt certificate and HSTS further complicates detection, as these features are typically associated with benign sites.

However, the combination of multiple vendor detections, blocklist listings, a zero trust score, and a phishing‑oriented page title provides a strong indicator of malicious intent. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as no page content beyond the title has been captured.