dashboard-theindex[.]finance

On 25 July 2026 a new second‑level domain dashboard-theindex.finance was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to the public IPv4 address 188.114.96.3 and uses Cloudflare authority‑controlled name servers kip.ns.cloudflare.com and meera.ns.cloudflare.com, indicating that the attacker is leveraging Cloudflare’s DNS infrastructure, a common tactic to provide redundancy and hide the true origin of the hosting service. As of 26 July 2026 the domain remains active and appears on a single security blocklist; PhishDestroy has listed it as a phishing source. The domain was submitted to VirusTotal where 91 scanning engines evaluated the associated host and URL payloads, and at the time of analysis no engine reported a detection.

While the absence of detections does not confirm benign intent, it suggests that the malicious payload, if any, may be employing evasion techniques or has not yet been captured by the scanners. No public SSL certificate details, HTTP response codes, page titles, or content snapshots have been released, so the visual or functional characteristics of the site cannot be described at this stage. Likewise, there is no evidence of Safe Browsing or OTX entries linking the domain to known campaigns. The limited visibility implies that the phishing operation is either newly deployed or deliberately restricting exposure to automated crawlers.

Given the combination of recent registration, active resolution, Cloudflare name‑server usage, and inclusion on a phishing blocklist, the domain should be treated as a high‑confidence phishing infrastructure. Defensive teams are advised to add 188.114.96.3 and the fully qualified domain name to outbound and inbound filtering policies, monitor DNS queries for the associated Cloudflare name servers, and consider sharing the indicator with internal threat‑intel feeds.