xn--of1-j63m[.]com

The domain xn--of1-j63m.com was registered on February 23, 2026 through NiceNIC International Group Co., Limited and currently resolves to the IP address 188.114.97.3, which is owned by Cloudflare Inc. (AS13335) and geolocated to the United States. The site presents a Korean page title, "벳계열유진 도메인 안내," suggesting an attempt to appear as a betting‑related service, but no further branding or content details have been publicly disclosed. No SSL/TLS certificate is associated with the domain, indicating that connections would be unencrypted if the site were accessed. The domain is listed on a single security blocklist and has been flagged by PhishDestroy, confirming that at least one anti‑phishing organization considers it malicious.

VirusTotal records show that two of ninety‑three scanning engines have raised detections against the domain, providing independent corroboration of suspicious activity. Nameserver configuration points to ulla.ns.cloudflare.com and uriah.ns.cloudflare.com, both standard Cloudflare resolvers, which is consistent with the hosting provider identified for the IP address. The domain is presently taken offline, limiting immediate exposure, but its recent creation date, short‑lived activity, and alignment with known phishing infrastructure suggest it was likely deployed for a brief, targeted campaign.

Defenders should monitor traffic to 188.114.97.3 for any residual connections, block the domain at the DNS and proxy layers, and incorporate the hash of the page title into content‑filtering rules. Given the limited detection coverage, additional sandbox analysis of any retrieved page content is recommended to uncover potential payloads or credential‑harvesting mechanisms. Organizations should also update internal threat‑intel feeds with the domain, registrar, and hosting details to improve early warning capabilities for similar Cloudflare‑based phishing deployments.