The site is hosted on a newly registered .cfd domain and is protected behind a Cloudflare block page, which is a strong indicator of malicious intent and anti-scraping measures. The WHOIS shows a domain age of 3 days, and the SSL cert is a Let’s Encrypt issuance dated the same day, which is typical for low-cost or ephemeral phishing setups. The scanner was blocked by a WAF, which reinforces that operators are actively evading automated analysis. While the exact brand being impersonated cannot be determined from the block page, the combination of rapid domain creation, suspicious TLD, and phishing-blocked content signals high abuse risk requiring urgent takedown actions.