limbaetvq[.]one

Analysis of limbaetvq.one shows that the domain is currently offline, returning HTTP 403 with the page title “Just a moment…”. The domain resolves to the Cloudflare‑owned address 188.114.96.3, which is associated with the IP location CA and presents a TLS certificate issued by Google Trust Services under the WE1 root. Registration was performed through NameSilo, LLC and the authoritative nameservers are armfazh.ns.cloudflare.com and emily.ns.cloudflare.com. The domain has been referenced in three AlienVault OTX threat‑intel pulses and appears on three public blocklists. Defensive feeds such as PhishDestroy, MetaMask and SEAL have already listed it as malicious. These artifacts collectively indicate that the domain was used for a generic phishing campaign and has been taken down or otherwise rendered inaccessible. At present, the exact content that triggered the phishing classification is not publicly disclosed, and no further hosting or payload details are observable. Defenders should continue to block the resolved IP address and the domain name at DNS and proxy layers, monitor for any re‑registration or reuse of the same nameservers, and incorporate the indicator set (domain, IP, certificate details) into threat‑intel feeds. Ongoing observation is recommended to confirm that the infrastructure does not reappear under a new label.