idn[.]topcashback[.]cloud

Analysis of the domain idn.topcashback.cloud indicates it is a phishing site targeting users of the cashback service TopCashback, though the exact content and mechanics remain unconfirmed due to its offline status. The domain was registered on March 3, 2026, through GoDaddy.com, LLC, and is hosted on Cloudflare infrastructure, resolving to the IP address 104.21.59.222 (AS13335, United States). Nameservers cesar.ns.cloudflare.com and eleanor.ns.cloudflare.com further confirm Cloudflare as the hosting provider, with an SSL certificate issued by Let's Encrypt. The page title 'Topback' suggests an attempt to impersonate TopCashback, though no additional brand-specific artifacts or phishing kits have been identified in available data. Detection metrics reveal limited but actionable intelligence.

The domain appears on one security blocklist and is flagged by PhishDestroy. Gridinsoft assigns a trust score of 0/100, indicating high risk. VirusTotal shows a single detection out of 94 vendors, which, while minimal, aligns with early-stage phishing campaigns before broader vendor coverage. The domain is currently offline, which may reflect takedown efforts or operational dormancy. Defenders should treat this domain as a confirmed phishing threat based on its registration details, hosting patterns, and detection history.

The use of Cloudflare is consistent with modern phishing infrastructure, often employed to obscure origin servers and evade IP-based blocking. The Let's Encrypt SSL certificate, while standard for legitimate sites, is frequently exploited in phishing to lend a false sense of legitimacy. Given the domain's offline status, further forensic analysis of cached content or historical snapshots may be required to determine the full scope of the campaign. Organizations should proactively block the domain and IP, monitor for related domains leveraging similar naming conventions (e.g.