adjara-gudju2[.]cfd

This domain is flagged as a credential harvesting phishing threat with an elevated risk level. Analysis indicates the infrastructure is designed to mimic legitimate login portals, tricking users into submitting sensitive authentication details such as usernames, passwords, and multi-factor authentication codes. The domain exhibits characteristics consistent with targeted phishing campaigns, including the use of evasive hosting and SSL encryption to appear legitimate. Infrastructure analysis reveals the following technical indicators: adjara-gudju2.cfd is detected by 10 out of 95 security vendors on VirusTotal, resolves to IP address 188.114.97.3, and was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It appears on one security blocklist and has a Gridinsoft trust score of 0/100. The domain employs Cloudflare for hosting and traffic analysis, including Cloudflare Browser Insights and HTTP/3 protocol support. The SSL certificate is issued by Google Trust Services, further attempting to legitimize the malicious endpoint. Mitigation steps for this credential harvesting threat include immediate blocking of the domain and its resolving IP (188.114.97.3) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) to endpoint detection systems and conduct retrospective log analysis for connections to adjara-gudju2.cfd or its IP. Users who may have interacted with the domain should be required to reset credentials via a secure, out-of-band method. Organizations should also review authentication logs for anomalous login attempts following potential exposure to this phishing infrastructure.