protocol-bio[.]xyz

Analysis of protocol-bio.xyz indicates a recently established phishing domain leveraging Cloudflare infrastructure. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with abusive registrations. As of July 24, 2026, the domain resolves to the IP address 188.114.97.3, which is part of AS13335 (Cloudflare, Inc.) and geolocated in the United States. The nameservers chip.ns.cloudflare.com and nucum.ns.cloudflare.com further confirm Cloudflare as the hosting provider, while the SSL certificate is issued by Google Trust Services (WE1), a common configuration for domains utilizing Cloudflare services. Detection data reveals limited but notable indicators of compromise.

The domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 5 out of 93 security vendors on VirusTotal, suggesting moderate confidence in its malicious classification. The observed page title, 'Just a moment...', is consistent with Cloudflare's default interstitial page, which may indicate either an incomplete phishing deployment or an attempt to evade initial detection by presenting minimal content. Technologies detected include Cloudflare Browser Insights and HTTP/3, aligning with standard Cloudflare deployments. The domain is currently offline, which may reflect takedown efforts or temporary suspension by the registrar or hosting provider.

However, the infrastructure remains intact, and the domain could be reactivated. Defenders should monitor for renewed activity, particularly given the use of Cloudflare, which is frequently exploited to obscure hosting origins and evade IP-based blocking. The absence of additional context regarding the specific phishing lure or targeted brand limits further classification, but the combination of a recent registration, Cloudflare hosting, and detection by security vendors warrants elevated scrutiny.