cabernalone[.]com

On July 20, 2026, analysts examined cabernalone.com, a domain registered four days earlier on July 16, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain is delegated to Cloudflare’s authoritative name servers melody.ns.cloudflare.com and shane.ns.cloudflare.com and resolves to the IP address 188.114.96.3, which is part of Cloudflare’s edge network. The short age of the registration, combined with the use of a reputable CDN, is a pattern frequently observed in phishing infrastructure designed to benefit from the reputation of the hosting provider while limiting traceability. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. VirusTotal records indicate that the domain was scanned by 95 anti‑malware vendors, none of which raised a detection at the time of analysis; however, the absence of a detection does not constitute a safety assurance. No additional public threat‑intel feeds such as OTX or Google Safe Browsing have published indicators for this host, and no SSL certificate details, HTTP response codes, or page‑title metadata have been disclosed publicly. Given the current evidence, the primary confidence factor is the explicit classification of the domain as a “generic phishing” seed, the recent creation date, and the fact that it is already being blocked by a dedicated phishing protection service. The lack of further telemetry—such as observed malicious payloads, phishing landing‑page content, or victim reports—means the full scope of the campaign remains uncertain. Defenders should add cabernalone.com to inbound and outbound filtering rules, monitor DNS queries for the domain, and consider pre‑emptively blocking the associated IP address 188.114.96.3, especially for any services that rely on Cloudflare edge nodes. Continuous re‑evaluation is advised, as future scans or intelligence feeds may reveal additional malicious activity.