rapido-envio[.]cfd

The domain rapido-envio.cfd was observed on July 12, 2026 and is currently classified as a high‑risk generic phishing site. The domain was created on April 15, 2026 and is registered through Dynadot LLC. It resolves to the IPv4 address 188.114.96.3, which is associated with a CloudFlare, Inc. network located in Canada. The authoritative nameservers are dilbert.ns.cloudflare.com and margot.ns.cloudflare.com, indicating that the domain’s DNS is hosted on the same provider. HTTP requests to the domain return a 301 redirect response, and the TLS certificate presented is issued by Google Trust Services under the WE1 certificate authority. The page title returned by the server is “Top Porn Sites”, but the full content of the landing page has not be​en publicly analyzed. The domain is listed on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal scanning shows that 2 of 95 security vendors have flagged the domain, and Gridinsoft assigns it a trust score of 0 out of 100, reflecting a high confidence in malicious intent. No additional intelligence, such as malware payloads or credential‑harvesting forms, has been released, leaving the exact phishing vector undefined beyond the generic classification. Given the recent creation date, the presence of a CloudFlare‑managed IP, and the low trust score, defenders should treat rapido‑envio.cfd as a hostile indicator. Organizations are advised to add the domain to internal blocklists, monitor DNS queries for look‑ups to 188.114.96.3, and enforce TLS inspection policies to capture any potential credential submissions. Continuous monitoring of blocklist updates and periodic rescanning on VirusTotal or comparable platforms are recommended to capture any changes in detection status.