p4-canton[.]com

This domain is flagged as a generic phishing endpoint targeting user credentials through deceptive login portals. Analysis indicates an elevated risk level due to confirmed malicious activity, including the use of obfuscation techniques such as Cloudflare proxy services to conceal the true origin of the attack infrastructure. The page title 'Just a moment...' suggests an attempt to mimic legitimate interstitial loading screens, a common tactic to delay detection while harvesting credentials or deploying secondary payloads. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.21.23.177, a Cloudflare-hosted endpoint, and was registered on February 21, 2026, through NiceNIC International Group Co., Limited. Security vendor detections on VirusTotal report 5/95 flags, while the domain appears on 2 independent security blocklists. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. Technologies detected include Cloudflare Browser Insights and HTTP/3, further indicating the use of modern evasion techniques to bypass traditional security controls. Mitigation steps for this threat type include immediate blocking of the domain and associated IP (104.21.23.177) at the network perimeter. Security teams should prioritize monitoring for connections to this IP, particularly from endpoints exhibiting unusual authentication patterns or unexpected Cloudflare proxy traffic. User awareness training should emphasize the risks of entering credentials on pages displaying generic loading messages ('Just a moment...') or those lacking clear brand affiliation. Additionally, organizations should review registrar data for domains created via NiceNIC with similar naming patterns (e.g., alphanumeric prefixes) and preemptively flag them for enhanced scrutiny.