mainnetfrontend[.]com

Analysis indicates that the domain mainnetfrontend.com was registered on 21 February 2026 through MAT BAO CORPORATION and immediately pointed to the IP address 172.67.195.96, which belongs to AS13335 Cloudflare, Inc. The domain resolves to Cloudflare’s edge infrastructure and uses Cloudflare‑provided nameservers (abby.ns.cloudflare.com, yahir.ns.cloudflare.com). The TLS certificate presented is issued by Google Trust Services under the WE1 root, a common certificate chain for legitimate Cloudflare‑protected sites, suggesting the attackers leveraged Cloudflare’s CDN to host the malicious content. The page title returned by the site, “Suspected phishing site | Cloudflare,” directly references the target brand and confirms the intent to impersonate Cloudflare. Detected technologies include Cloudflare’s own services and HTTP/3, further corroborating the use of Cloudflare’s network.

The registrar’s trust score, as reported by Gridinsoft, is 0 out of 100, indicating a high likelihood of abuse. The domain is currently offline, but historical scans show that eight of ninety‑five VirusTotal scanners flagged the site, and the domain appears on five independent blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. These detections align with the declared scam type of brand impersonation. Uncertainty remains regarding the specific payload or credential‑collection mechanisms, as no page content beyond the title has been publicly disclosed.

Additionally, the short lifespan (registered less than five months before takedown) limits the ability to observe any post‑compromise activity. Defenders should continue to block the domain at network perimeters, update URL filtering lists with the observed blocklist entries, and monitor for any new subdomains or related registrants that reuse the same nameserver pattern or IP range. Threat‑intelligence feeds should flag mainnetfrontend.