madridbossown[.]com

The domain madridbossown.com is currently active and serves a page titled “Just a moment…”. DNS resolution points to 188.114.97.3, hosted behind Cloudflare (nameservers amalia.ns.cloudflare.com and jihoon.ns.cloudflare.com). The site presents a TLS certificate issued by Let’s Encrypt (E8) and responds with HTTP 403, indicating that the original content is being shielded by Cloudflare’s edge protection. Infrastructure analysis shows the hosting IP belongs to AS13335 Cloudflare, Inc., located in the United States. The domain was registered on 27 February 2026 through NiceNIC International Group Co., Limited. Reputation data is poor: Gridinsoft assigns a trust score of 0/100, the domain appears on the PhishDestroy blocklist, and 2 of 93 VirusTotal scanners have flagged it. The combination of a recent registration, low trust score, presence on a phishing blocklist, and the “Just a moment…” landing page are consistent with a generic phishing deployment, although no payload or target brand has been observed. Defenders should block the domain at perimeter firewalls and DNS filtering, monitor for outbound connections to the underlying Cloudflare IP, and consider adding the indicator to internal threat‑intel feeds. Because the site is protected by Cloudflare, direct content inspection may be limited; threat‑hunting should focus on network‑level anomalies and credential‑leak patterns that could be associated with this indicator.