poteda[.]cfd

This domain, poteda.cfd, was registered on October 15, 2025 through Web Commerce Communications Limited and is currently taken offline. DNS resolution points to the Cloudflare edge address 188.114.97.3, which belongs to AS13335 and is geolocated in the United States. The authoritative name servers are lovisa.ns.cloudflare.com and vicky.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate is presented, meaning the site would have been served over plain HTTP if accessed.

The only visible page title returned during the brief crawl was “Nur einen Moment…”, a German phrase that provides no indication of the targeted brand or campaign. The domain appears on a single public blocklist, specifically PhishDestroy, and has been flagged by three of ninety‑five VirusTotal scanners, reflecting modest detection coverage. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the low reputation. Because the site is offline, active content cannot be inspected, and the exact phishing payload or credential‑stealing technique remains unknown.

Defenders should continue to block the domain at perimeter devices, ensure that any outbound connections to the IP 188.114.97.3 are denied, and monitor for any residual references in email or web traffic. Additional verification can be performed by querying Cloudflare’s DNS logs for historical request patterns and by reviewing any internal alerts that may have captured the domain before it went offline. Maintaining the block on PhishDestroy and updating local blocklists with the domain will reduce the risk of inadvertent user exposure while investigations continue.