depop[.]n24order[.]rest

Analysis of depop.n24order.rest confirms it as a phishing domain targeting Depop users, currently offline but previously active under elevated-risk classification. The domain was registered on November 21, 2025, through Web Commerce Communications Limited, with nameservers rajeev.ns.cloudflare.com and roxy.ns.cloudflare.com, indicating Cloudflare DNS management. It resolved to IP 188.114.96.3, part of AS13335 (Cloudflare, Inc.), a common hosting choice for both legitimate and malicious infrastructure. No SSL certificate was detected, increasing exposure to interception and reducing trust signals for visitors.

The page title 'Nur einen Moment…' suggests a transient loading or redirect page, commonly used in phishing kits to mask the final malicious destination or delay user interaction. While the exact content and phishing kit remain unanalyzed, the domain appears on at least one security blocklist and is flagged by 7 of 95 vendors in VirusTotal scans, with PhishDestroy explicitly blocking it. Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification. Defenders should treat this domain as confirmed hostile infrastructure.

The absence of SSL, Cloudflare hosting, and the short lifespan (registered in late 2025, offline by mid-2026) align with typical phishing domain behavior. Network-level blocks should be applied to 188.114.96.3 and related Cloudflare IPs if recurring patterns emerge. Registrar abuse contacts should be notified for potential takedown, though the domain is already inactive. Further monitoring is advised for related subdomains or newly registered lookalike domains under the n24order.rest parent.