symbiosis-finance[.]app

Analysis of the domain symbiosis-finance.app, created on February 21 2026 and hosted behind Cloudflare (ASN 13335), shows multiple indicators of malicious activity. The site returns an HTTP 301 redirect and resolves to IP 104.21.72.228, which is located in the United States and belongs to Cloudflare’s network. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming that HTTPS is in place but offering no guarantee of legitimacy. The page title observed is “Success!”, a generic label that provides no insight into the intended content. Gridinsoft assigns a trust score of 0 / 100, and one of ninety‑three VirusTotal scanners flags the domain, reinforcing the suspicion of abuse.

The domain is listed on two external blocklists and has been actively blocked by PhishDestroy and ScamSniffer, both of which specialize in phishing detection. Nameserver configuration uses alice.ns.cloudflare.com and leonard.ns.cloudflare.com, consistent with the Cloudflare front‑end. The registrar listed is OwnRegistrar, Inc., indicating a low‑cost or possibly disposable registration service, which is a common pattern for short‑lived malicious sites. No further technical artifacts such as malicious payloads, credential‑stealing forms, or redirection chains have been disclosed, leaving the exact phishing vector uncertain.

However, the combination of a newly registered domain, zero trust score, active blocklist entries, and a single VirusTotal detection provides sufficient confidence to classify the domain as a high‑risk phishing resource. Defenders should add symbiosis-finance.app to DNS and URL filtering policies, monitor for outbound connections to the associated IP address, and consider network isolation of any internal hosts that attempt to resolve the domain. Continuous re‑evaluation is advised, as the site may evolve its content or hosting infrastructure.