onyxcyberwarden[.]de

On July 25, 2026, the domain onyxcyberwarden.de was observed hosting a generic phishing site that presented a page titled “Support”. The site was served through Cloudflare’s network (AS13335) and resolved to the IPv4 address 172.67.205.95, which is located in the United States. DNS resolution used the Cloudflare‑provided authoritative name servers selah.ns.cloudflare.com and venkat.ns.cloudflare.com. The TLS certificate was issued by Google Trust Services under the WE1 intermediate, confirming the use of a legitimate certificate chain but not providing any authenticity for the underlying content. HTTP traffic was delivered over HTTP/3 and included Cloudflare Browser Insights, indicating that the operator leveraged Cloudflare’s performance and security services.

VirusTotal recorded a single positive detection out of 93 scanned scanners, suggesting that at least one security vendor flagged the domain as malicious. The domain is currently listed on one public blocklist and is actively blocked by PhishDestroy, reinforcing the consensus that it is being used for phishing. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence in the site’s legitimacy. The site’s status is reported as offline at the time of analysis, which may be a temporary takedown or a change in hosting configuration. Evidence does not reveal the specific brand or service being spoofed beyond the generic “Support” page title, and no additional artifacts such as login forms or credential‑harvesting URLs have been captured.

Consequently, the precise victim‑targeting vector remains uncertain. Analysts should continue to monitor DNS queries for the domain, enforce blocklist rules that include the associated IP address range, and consider adding the domain to internal phishing detection feeds. Organizations using email gateways or web proxies should ensure that any URLs resolving to onyxcyberwarden.