ureiswanrp[.]cc

This domain, ureiswanrp.cc, was registered on 2026-02-21 and is presently offline. VirusTotal records indicate that nine out of ninety-three scanning engines flagged the host as malicious, suggesting a consensus of moderate confidence in its phishing intent. The domain resolves to the IP address 172.67.131.152, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The TLS certificate presented is identified as WE1, but no additional certificate metadata is disclosed.

The only visible HTML title is “FASTPANEL”, a generic control-panel label that does not reveal the targeted brand. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service. No further intelligence such as Safe Browsing status, OTX tags, or additional vendor detections is provided. Based on the available artifacts, the infrastructure appears to rely on Cloudflare’s CDN, a common tactic for fast-flux or short-lived phishing operations.

The limited blocklist presence and modest detection count indicate that the campaign may be in an early stage or that automated scanners have not fully indexed the site before it was taken down. Defenders should add ureiswanrp.cc to local deny lists, monitor the associated IP range for any resurgence, and ingest the VirusTotal detection metadata into SIEM correlation rules. Continuous observation of Cloudflare-hosted IPs that appear in phishing feeds is recommended, as the adversary could redeploy the same domain or reuse the hosting provider for future campaigns.