sing-operador3[.]cfd

Analysis of sing-operador3.cfd indicates that the domain was registered on November 14, 2025 through NameSilo, LLC and is currently offline after being taken down by PhishDestroy. The domain resolves to 172.67.128.83, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. DNS is served by Cloudflare name servers elma.ns.cloudflare.com and titan.ns.cloudflare.com. No SSL certificate is present, meaning any HTTP connection would be unencrypted.

The page title returned from the live host before takedown reads "Google Ads - Get Customers and Sell More with Online Advertising," and the site claims to impersonate the brand "across," suggesting a generic brand‑impersonation campaign rather than a targeted brand spoof. Security‑vendor scoring is extremely low, with Gridinsoft assigning a trust score of 0 out of 100. VirusTotal reports that 14 of 95 scanned engines flagged the domain, and it appears on at least one external blocklist. The lack of a valid TLS certificate combined with a low trust score and multiple vendor detections raises a high confidence that the domain was used for malicious brand‑impersonation activity.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host or related IP ranges, and consider adding the IP 172.67.128.83 to threat‑intel feeds. Because the site is offline, additional forensic collection is limited; however, the existing indicators—registration date, hosting details, vendor flags, and the misleading page title—provide sufficient evidence to treat the domain as a confirmed malicious actor targeting brand trust. Ongoing vigilance is advised, especially for organizations that reference the "across" brand or that rely on Google Ads‑related communications, to prevent credential harvesting or fraudulent advertising exploits.