894938[.]com

Analysis indicates that the domain 894938.com was registered on July 13, 2026 through NameSilo, LLC and is currently pointed at the Cloudflare name servers chad.ns.cloudflare.com and dolly.ns.cloudflare.com. The domain presents a valid TLS certificate issued by Let’s Encrypt (identifier YE1) and resolves to the IPv4 address 91.92.35.67. VirusTotal records show the domain has been scanned by 91 security vendors with no current flags, however the absence of detections does not imply benign intent. The domain is classified as a generic_phishing infrastructure and remains active as of the report date. No public page content or phishing kit details have been released, so the exact lures or credential‑harvesting mechanisms remain unknown. Defenders should consider adding 894938.com and its resolving IP to block lists, enforce TLS inspection to detect any potential credential capture, and monitor DNS queries for the associated Cloudflare name servers. Continued observation is recommended to capture any future payloads or victim reports that would clarify the scope of the campaign.