proton-network[.]com

Analysis of proton-network.com as of July 19, 2026, indicates a domain exhibiting characteristics consistent with phishing infrastructure. The domain is currently active, returning an HTTP 301 redirect, which is a common technique used in phishing campaigns to obscure final malicious destinations. Infrastructure analysis reveals it is hosted behind Cloudflare (nameservers clyde.ns.cloudflare.com and connie.ns.cloudflare.com), resolving to IP 104.21.68.204, located in Canada. The SSL certificate is issued by Let's Encrypt (YE2), a legitimate provider often abused for malicious purposes due to its accessibility. The domain appears on one security blocklist and has been flagged in two threat intelligence pulses on AlienVault OTX, though no specific brand or scam type is confirmed at this time. Registration details point to Fewmoretaps OU d/b/a Trustname.com, a registrar occasionally associated with abusive domains. Notably, 91 vendors scanned the domain on VirusTotal, with zero detections as of the latest analysis; however, this absence does not confirm safety and should not be interpreted as an all-clear. Defenders are advised to treat this domain as suspicious pending further investigation. Network-level blocking or monitoring of the IP 104.21.68.204 and associated domain is recommended, particularly for organizations that may be targeted by phishing campaigns. The HTTP 301 redirect should be traced to its final destination if possible, as this may reveal additional indicators of compromise. No confirmed victim reports or specific phishing kit associations are available at this time.