lorengettrix[.]cfd

This domain, lorengettrix.cfd, was registered on 30 April 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently hosted on the IP address 195.123.218.3, served by Cloudflare name servers rachel.ns.cloudflare.com and simian.ns.cloudflare.com. Threat intelligence platforms PhishDestroy and ScamSniffer have both added the domain to their blocklists, and it also appears on two additional security blocklists. VirusTotal analysis shows that five out of ninety‑one scanning engines returned a malicious verdict, indicating a non‑trivial detection rate. The domain is classified as a generic phishing site with an elevated risk rating and remains active as of the report date, 29 July 2026.

The available data does not include a page title, SSL certificate details, HTTP response codes, or any observed landing‑page content, so the exact phishing vector and targeted brand cannot be confirmed at this time. Likewise, no information on associated malware kits, compromised credentials, or victim reports has been published. The lack of publicly disclosed content means that automated content‑based detection may be limited, but the presence on multiple blocklists and the positive VirusTotal detections provide sufficient indicators for defensive systems to act. Defenders should update perimeter filters to block both the domain name and its resolving IP address.

In addition, DNS sinkholing or response policy zones can be used to intercept queries to the Cloudflare name servers. Endpoint security products that integrate VirusTotal scores should be configured to flag the domain when any of the five detecting engines raise an alert. Continuous monitoring of the IP address for new associations and periodic re‑scanning of the domain on VirusTotal are recommended to capture any changes in its threat profile. Organizations that employ URL filtering should add lorengettrix.