vertexcapital[.]cfd

Analysis of vertexcapital.cfd shows a newly registered domain created on 21 February 2026 through NiceNIC International Group Co., Limited. The authoritative name servers are aron.ns.cloudflare.com and ashton.ns.cloudflare.com, indicating Cloudflare DNS services. The domain resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was observed, and an HTTP request returns the title “404 Not Found”, suggesting that the web server is either misconfigured or deliberately serving an error page.

The domain has been listed by the PhishDestroy blocklist and appears on a single security blocklist. VirusTotal scans have flagged the domain in six out of ninety‑five AV engines, providing additional confirmation of malicious intent. The threat type is identified as generic phishing, and the current operational status is offline, meaning the site is no longer reachable.

While the limited data set does not reveal the specific phishing lure or targeted brand, the combination of recent registration, Cloudflare hosting, lack of SSL, and multiple vendor detections aligns with typical infrastructure used for short‑lived phishing campaigns. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and consider adding the IP address 188.114.97.3 to reputation‑based deny lists. Ongoing observation of Cloudflare‑associated IP ranges is recommended, as adversaries frequently recycle such infrastructure for new campaigns.