humidi[.]fi

This domain, humidi.fi, was registered on August 28, 2025, through NETIM and is currently active as of August 4, 2026. Infrastructure analysis reveals it resolves to IP address 104.21.3.32 and uses Cloudflare nameservers (addilyn.ns.cloudflare.com and marvin.ns.cloudflare.com), a common pattern observed in phishing campaigns leveraging Cloudflare's CDN and proxy services to obscure origin servers. The domain appears on one security blocklist, specifically PhishDestroy, indicating prior suspicion or confirmed malicious activity.

No detections were reported by the 91 vendors that scanned the domain on VirusTotal, though this absence does not confirm safety or benign intent. The exact nature of the phishing content hosted on humidi.fi remains unconfirmed, as no brand target, scam type, or page title details are available in the current intelligence. The domain is classified as generic phishing pending further analysis.

Defenders are advised to monitor network traffic for connections to 104.21.3.32 or DNS queries for humidi.fi, particularly in environments where Cloudflare-hosted domains are uncommon. Blocking the domain at the perimeter, based on its presence on PhishDestroy, is recommended until additional context or takedown occurs. Further investigation into associated infrastructure, SSL certificates, and historical DNS records may provide additional indicators of compromise or campaign linkages.