poshmarkif[.]com

Analysis of poshmarkif.com shows that the domain was created on February 21, 2026 and registered through NiceNIC International Group Co., Limited. DNS resolution points to 104.21.59.196, an address owned by Cloudflare (AS13335) and geolocated in the United States. The site currently returns a minimal HTTP response with the title “Just a moment…”, and no TLS certificate is presented, indicating that the service is operating without encrypted transport. Technology fingerprints reveal a Node.js runtime backed by the Express framework, delivery of assets via jsDelivr, and the use of Cloudflare’s edge network with HTTP/3 enabled.

All four authoritative nameservers—junade.ns.cloudflare.com, kehlani.ns.cloudflare.com, pablo.ns.cloudflare.com, and raina—are Cloudflare‑managed, confirming that the domain relies exclusively on Cloudflare for DNS and CDN services. Threat intelligence data indicates that three of ninety‑three VirusTotal scanners have flagged the domain, and it appears on a single security blocklist. PhishDestroy has actively blocked the domain, suggesting that the infrastructure has been identified as part of a phishing campaign. The lack of a valid SSL certificate, combined with the generic page title and the presence of Node.js/Express components, aligns with patterns commonly observed in disposable phishing landing pages that serve a brief interstitial before redirecting victims to credential‑harvesting sites.

Because the domain is presently taken offline, immediate malicious activity is not observable, but the infrastructure remains under the control of the same hosting provider and registrar. Defensive operators should continue to enforce blocklist entries for 104.21.59.196 and any sub‑domains of poshmarkif.com, monitor Cloudflare‑associated IP ranges for similar patterns, and consider adding the domain to internal URL filtering policies.