eu[.]ler-lend[.]icu

The domain eu.ler-lend.icu was registered on November 24, 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 104.21.12.233, which is located in the United States under ASN 13335. The site presents an HTTP response with the page title "Index of /" and does not serve an SSL certificate, indicating that any data submitted would be transmitted unencrypted. Google Safe Browsing classifies the domain as a social engineering threat, and nine of ninety‑five VirusTotal scanners have flagged it, reflecting a moderate detection consensus.

PhishDestroy has actively blocked the domain and it appears on a single external blocklist, reinforcing the perception that it is being used for malicious purposes. Gridinsoft assigns a trust score of 0 out of 100, and the lack of HTTPS further degrades its credibility. The nameservers maciej.ns.cloudflare.com and saanvi.ns.cloudflare.com confirm that the domain is hosted on Cloudflare's infrastructure, a common choice for fast‑flux or disposable phishing sites.

While the exact phishing campaign details, such as targeted brands or credential‑harvesting pages, have not been observed, the combination of social‑engineering classification, multiple vendor detections, and a zero‑trust score suggests the domain is intended for credential collection or fraud. Defenders should continue to block the domain at network perimeter devices, update DNS blacklists with the observed IP and hostname, monitor for any resurgence of activity, and advise users to avoid interacting with any links pointing to eu.ler-lend.icu, especially given its lack of encryption and known malicious indicators.