posten[.]bokdgorkogoe[.]cfd

The domain posten.bokdgorkogoe.cfd was registered on December 8, 2025 through Global Domain Group LLC and is explicitly listed as impersonating the Norwegian postal service, Posten Norge. Infrastructure analysis shows the domain resolves to the IP address 172.67.193.123, which belongs to AS13335 Cloudflare, Inc., placing the hosting location in the United States. No TLS certificate is presented, indicating the site was served over plain HTTP at the time of observation. The authoritative name servers are mira.ns.cloudflare.com and todd.ns.cloudflare.com, both operated by Cloudflare, confirming the use of a reputable CDN for rapid deployment.

The page title returned during the brief crawl was "Bukseppake | POSTEN.NO," matching the targeted brand’s naming convention and reinforcing the brand‑impersonation intent. Threat intelligence flags the domain on a single security blocklist and it has been actively blocked by the PhishDestroy sinkhole, resulting in an offline status at the time of reporting. VirusTotal analysis recorded 13 positive detections out of 93 scanned engines, providing independent corroboration of malicious intent. The Gridinsoft trust score of 0 out of 100 further reflects a lack of credibility.

While the domain’s content has not been fully captured, the combination of brand‑specific page title, registrar details, Cloudflare hosting, and multiple vendor detections establishes a clear pattern of brand impersonation. Defenders should add posten.bokdgorkogoe.cfd to URL filtering and DNS blocklists, monitor the associated IP range for any future activity, and watch for re‑registration attempts. Continuous observation of the Cloudflare name servers for new sub‑domains is advised, as threat actors often reuse the same hosting infrastructure for subsequent campaigns.