us605web[.]us

The domain us605web.us was registered on February 21, 2026 through Web Commerce Communications Limited and is presently taken offline. Infrastructure analysis shows that the domain resolves to IP address 76.76.21.22, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No SSL certificate is presented, indicating that the site operated over plain HTTP when it was active. The authoritative nameservers are justin.ns.cloudflare.com and margot.ns.cloudflare.com, both part of Cloudflare’s DNS service.

The page title observed during the brief live window was "Home – Huddle01's Documentation," but no further content analysis is available. The campaign is classified as brand impersonation targeting Discord, as indicated by the intelligence feed. Detection evidence includes placement on three security blocklists and explicit blocking by PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust score of 0 out of 100 reflects a high‑risk assessment.

VirusTotal recorded two positive detections out of ninety‑three scanned engines, confirming that at least a minority of security products flagged the domain as malicious. Overall, the available data confirms that us605web.us was used in a Discord‑impersonation operation and that its hosting relied on Cloudflare’s network. Uncertainty remains regarding the exact phishing page layout, credential‑capture mechanisms, and any associated command‑and‑control infrastructure, as no further payload or traffic samples have been disclosed. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence of the same IP or nameserver pair, and incorporate the observed indicators—domain name, IP address, and associated blocklist entries—into threat‑intel feeds to pre‑empt future reuse.