s1-dreamcash[.]xyz

Analysis of s1-dreamcash.xyz shows a newly registered domain (created 27 February 2026) that resolved to the Cloudflare IP address 172.67.144.85, located in the United States and announced as AS13335 Cloudflare, Inc. The site was served under the Cloudflare‑managed nameservers donald.ns.cloudflare.com and etta.ns.cloudflare.com and did not present an SSL/TLS certificate, indicating plain‑HTTP delivery. The only visible page title was “Suspected phishing site | Cloudflare”, which is the default interstitial shown by Cloudflare when a domain is flagged for abuse. The domain received a Gridinsoft trust score of 0 / 100, the lowest possible rating, and appears on three independent security blocklists.

Commercial detection engines listed on VirusTotal flagged the domain in five of ninety‑three scans, confirming malicious intent. Multiple endpoint protection products, including PhishDestroy, MetaMask, and SEAL, have already blocked traffic to the domain. Current status is offline, suggesting the hosting has been taken down or the site is no longer serving content, but the infrastructure footprint remains observable.

Given the combination of recent registration, lack of encryption, low trust score, blocklist presence, and multiple vendor detections, the domain should be treated as a confirmed phishing infrastructure. Defenders are advised to add s1-dreamcash.xyz to DNS‑based deny lists, enforce outbound filtering for the associated IP range, and monitor for any future domains registered through NiceNIC International Group Co., Limited that resolve to Cloudflare IPs. Continuous telemetry on related AS13335 traffic and periodic re‑scans of the IP address are recommended to detect resurgence or re‑use of the hosting resources.