codattapoint[.]xyz

Analysis of codattapoint.xyz, created on February 21, 2026 and currently taken offline, shows a typical infrastructure pattern used by phishing operators. The domain resolves to 172.67.163.32, an address owned by AS13335 Cloudflare, Inc., confirming the use of Cloudflare’s CDN and the presence of Cloudflare Browser Insights and HTTP/3 support. The SSL certificate is issued by Google Trust Services under the WE1 label, providing a valid HTTPS endpoint that can lend superficial credibility to malicious pages. Nameservers luciana.ns.cloudflare.com and will.ns.cloudflare.com further indicate reliance on Cloudflare’s DNS services.

The site’s only visible attribute is a page title of “Just a moment…”, a generic placeholder that offers no insight into the intended victim flow or target brand. The domain has been blocked by the PhishDestroy service and appears on one external blocklist, suggesting that at least one security feed has flagged it as malicious. VirusTotal scans report five positive detections out of ninety‑three vendors, reinforcing the suspicion of phishing activity. Registration was performed through NiceNIC International Group Co., Limited, a registrar that does not appear to provide additional protective controls.

No evidence of additional hosting, content delivery networks, or backend services beyond Cloudflare is observable. Uncertainty remains around the exact phishing payload, target audience, and whether the domain may be re‑activated in the future. Defenders should add codattapoint.xyz to network and endpoint blocklists, monitor Cloudflare‑associated IP ranges for similar patterns, and consider proactive DNS sinkholing for the domain. Continuous re‑evaluation of the domain’s status is advised, as offline sites can be resurrected quickly under the same infrastructure.