xn--w-8sb2c7d[.]xn--o-6tb57d[.]xn--fhbrthu-2fgcb9c3f3as20afgd363ahai22dc4867njaee[.]fi-s2[.]eu[.]com

The domain xn--w-8sb2c7d.xn--o-6tb57d.xn--fhbrthu-2fgcb9c3f3as20afgd363ahai22dc4867njaee.fi-s2.eu.com was registered on 21 February 2026 through Instra Corporation Pty Ltd. The registrar information and the use of CentralNIC nameservers (ns1‑ns4.centralnic.net) are consistent with a rapid‑deployment infrastructure often observed in phishing campaigns. The domain resolves to IP 104.21.32.1, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. Cloudflare’s front‑end service provides anonymity for the underlying host, complicating direct attribution. A Gridinsoft trust score of 0 / 100 classifies the site as extremely untrustworthy.

The domain appears on a single security blocklist and is actively blocked by the PhishDestroy filtering service, indicating that at least one reputable anti‑phishing platform has identified malicious content. VirusTotal analysis shows five of ninety‑three scanning engines flagging the domain, reinforcing the suspicion of malicious intent. The SSL certificate labeled “WE1” is present, but no further validation details are available, which is typical for short‑lived phishing sites that obtain generic certificates to avoid browser warnings. MX records point to eu-com-wildcard-null-mx.centralnic.net, a null‑mail configuration often used to suppress inbound mail and reduce exposure.

The current operational status is listed as offline, suggesting the site has been taken down or is temporarily inaccessible. However, the existing infrastructure—Cloudflare edge, low trust score, blocklist presence, and multiple vendor detections—remains a viable indicator of a generic phishing operation. Defenders should continue to monitor the IP address and associated Cloudflare edge nodes for re‑use, enforce blocklist rules in perimeter defenses, and consider adding the domain to internal blacklists.