retard[.]acafdxiaharbor[.]com

This domain retard.acafdxiaharbor.com is flagged as an active generic phishing threat with a high risk level. Registered on October 24 2025 via Tucows Domains Inc., the domain resolves to IP 188.114.97.3 in the US under AS13335 Cloudflare Inc. Nameservers listed are daisy.ns.cloudflare.com and vick.ns.cloudflare.com while the SSL certificate is issued by Google Trust Services under the WE1 authority. HTTP responses return status 403 and the page title recorded is Nur einen Moment…. Current status remains active on the report date of July 12 2026.

Infrastructure analysis reveals consistent use of Cloudflare services including HTTP/3 and Cloudflare Browser Insights. The domain appears on one security blocklist and carries a Gridinsoft trust score of 0/100. VirusTotal data shows detections from 7 out of 95 security vendors. These indicators establish a technical profile consistent with known phishing infrastructure rather than benign hosting.

Uncertainties persist around the precise campaign mechanics because direct content inspection beyond metadata has not occurred. No brand target or specific phishing kit details are present in the available intelligence. The exact payload or redirection behavior therefore cannot be confirmed from the current data set alone.

Defenders should incorporate the IP address 188.114.97.3, the listed nameservers, and the domain itself into blocklists and monitoring rules. Traffic analysis for connections to this infrastructure is recommended alongside continued tracking of any newly registered subdomains sharing the same registration or hosting characteristics. Updates to detection signatures based on these concrete indicators will reduce exposure to the active threat.