presale[.]cambria[.]lat

presale.cambria.lat was registered on February 27, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain resolves to the IPv4 address 188.114.97.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. No SSL certificate is presented for the host, indicating that HTTPS is not enforced. Authoritative name servers are audrey.ns.cloudflare.com and rohin.ns.cloudflare.com, both belonging to the Cloudflare DNS service. The only visible artifact from the site is the page title “Even geduld…”. No further content has been captured, and the site is currently taken offline.

VirusTotal reports that the domain has been scanned by 93 AV engines, none of which have generated a detection. The domain appears on a single security blocklist, specifically PhishDestroy, which classifies it as a generic phishing site. No additional listings on public Safe Browsing feeds or Open Threat Exchange entries are observed. Infrastructure analysis shows a minimal footprint: a single A record pointing to a Cloudflare‑hosted IP, no TLS certificate, and reliance on Cloudflare’s DNS. The short lifespan—creation less than five months before the report date—combined with the lack of defensive mitigations suggests an opportunistic phishing campaign that was rapidly taken down.

Uncertainties remain regarding the exact phishing template, target audience, and whether any credentials were harvested before takedown. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration attempts, and add the observed IP address to threat‑intel feeds. Ongoing observation of Cloudflare‑associated IP ranges for similar short‑lived domains is recommended. The presence on PhishDestroy provides a reference point for automated blocklist consumption. Until further forensic evidence emerges, the domain should be treated as malicious and kept on blocklists.