netw0rkox-as2j[.]4everland[.]app

Analysis of netw0rkox-as2j.4everland.app shows that the domain was registered on February 21, 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network (AS13335) with the IP address 188.114.96.3, a location identified as the United States. The authoritative name servers listed are cody.ns.cloudflare.com and saanvi.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. The site presented an HTTP 404 response at the time of observation, indicating that no content was served when accessed. Despite the empty response, the domain was flagged by multiple security mechanisms: VirusTotal recorded detections from 15 of 93 scanned vendors, and the domain appears on at least one security blocklist.

It was also blocked by the PhishDestroy feed, reinforcing the classification as a malicious resource. The TLS certificate presented is issued by Google Trust Services under the WE1 root, a legitimate certificate authority, which does not mitigate the malicious intent inferred from other indicators. Detected technologies include Cloudflare’s edge services and HTTP/3, both typical of legitimate and malicious sites alike. The combination of recent registration, Cloudflare hosting, a valid SSL certificate, and multiple vendor detections suggests an active infrastructure used for phishing, even though the site is currently offline.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms because the HTTP 404 response prevents content analysis, and no page title or brand targeting information is available. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑appearance of active content, and consider adding the IP address 188.114.96.3 to threat intelligence feeds if not already present. Ongoing observation of Cloudflare‑associated domains with similar detection patterns is recommended, as attackers frequently rotate content while retaining the same hosting footprint.