app[.]ptfdi[.]net

app.ptfdi.net was registered on 27 March 2026 and is currently resolved to the Cloudflare‑owned address 188.114.97.3, which geolocates to Canada. The domain is served through Cloudflare’s DNS (kenia.ns.cloudflare.com, matt.ns.cloudflare.com) and presents a Let's Encrypt certificate issued by the E8 intermediate. An HTTP request returns status 403 and the page title is "Just a moment…", indicating that the site is intentionally obscuring its content. The domain appears on a single security blocklist and has a Gridinsoft trust score of 0 / 100. It is actively blocked by PhishDestroy and has been flagged by 4 of 94 VirusTotal scanners. The threat is classified as generic phishing and the risk level is high. No additional intelligence on the payload, targeted brand, or campaign infrastructure is available, so the exact malicious behavior remains uncertain. Defenders should add the domain and its IP to outbound filtering rules, monitor DNS queries for the domain and its nameservers, and ensure that any user‑initiated connections to the site are blocked. Continuous re‑scanning with multi‑engine services is recommended to capture any future changes in the detection profile.