xn--vmstkingsw-yqiaccg2e8hobakf8568mdahe52649f[.]gfox[.]eu[.]com

The domain xn--vmstkingsw-yqiaccg2e8hobakf8568mdahe52649f.gfox.eu.com was registered on February 21, 2026 and is currently active. It resolves to the IPv6 address 2a06:98c1:3120::3, which is announced by AS13335 Cloudflare, Inc. The domain is listed on a single security blocklist and is flagged by PhishDestroy as high‑risk. A recent HTTP request returns status code 521 and the page title reports "gfox.eu.com | 522: Connection timed out," indicating that the service is deliberately unavailable or misconfigured.

Infrastructure analysis shows the domain is served behind Cloudflare with HTTP/3 enabled and presents a valid Let’s Encrypt certificate (E7). The DNS configuration uses four CentralNic nameservers (ns1‑ns4.centralnic.net). Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal records a single positive detection out of 95 scanned vendors, reinforcing the suspicion of malicious intent despite the low detection count.

The limited visibility of the payload prevents a definitive description of the phishing content, but the combination of a newly created domain, low trust score, Cloudflare fronting, and blocklist inclusion aligns with typical generic phishing infrastructure. The absence of additional security vendor flags suggests the site may be employing evasion techniques such as rapid content changes or temporary hosting. Defenders should treat the domain as hostile until further forensic evidence is obtained.

Recommended actions include adding the domain to outbound filtering rules, monitoring DNS queries for the four CentralNic name servers, and employing sinkholing or DNS‑based blocking for the IPv6 address 2a06:98c1:3120::3. Continuous re‑assessment is advised, as the threat actor may activate the site or replace the payload at any time.