dementiamatters[.]net

Analysis of dementiamatters.net indicates a brand impersonation campaign targeting Cloudflare, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, through 123-Reg Limited and resolves to IP 104.21.0.132, hosted on Cloudflare's network (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare technologies, including HTTP/3, and nameservers dns1.namecheaphosting.com and dns2.namecheaphosting.com. The SSL certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36 hierarchy. The domain was flagged by PhishDestroy and appears on at least one security blocklist.

AlienVault OTX records show the domain in three threat intelligence pulses, suggesting prior malicious activity. VirusTotal reports 16 detections from 93 security vendors, though the specific nature of these detections remains unconfirmed. The HTTP status returned is 403, and the page title explicitly states 'Suspected phishing site | Cloudflare,' aligning with the reported brand impersonation scam type. Gridinsoft assigns a trust score of 0/100, reinforcing the domain's high-risk classification.

While the domain is currently offline, defenders should monitor for reactivation or shifts in infrastructure, such as changes in IP, nameservers, or SSL certificates. Network-level blocking of 104.21.0.132 and associated domains registered through 123-Reg Limited may mitigate residual risk. Further investigation into the Sectigo-issued certificate and Namecheap hosting patterns could reveal related threat clusters. The exact content or functionality of the phishing page is not yet analysed, but the available indicators confirm its targeting of Cloudflare users.