velfacilis[.]cfd

Analysis of the domain velfacilis.cfd indicates that the site was taken offline as of the report date. The domain was registered on November 27, 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare IP address 104.21.62.163, which is announced by AS13335 in the United States. The authoritative nameservers rachel.ns.cloudflare.com and simon.ns.cloudflare.com confirm that the domain is hosted behind Cloudflare’s CDN service. No TLS certificate is presented, meaning the site was served over plain HTTP when it was accessible.

The page title retrieved before takedown reads “Крепнейшая раздача от спонсоров”, a Russian phrase suggesting a promotional or giveaway theme, but no further content has been captured, leaving the exact phishing lure uncertain. The domain appears on a single security blocklist and received a trust score of 0 out of 100 from Gridinsoft, indicating a high confidence of malicious intent. PhishDestroy has already blocked the domain, and four of ninety‑three VirusTotal scanners flagged it as malicious, reinforcing the assessment. Given the Cloudflare hosting, any future re‑hosting of the same payload could reuse the same IP range, so defenders should consider IP‑based blocking in addition to domain‑level denial.

Continuous monitoring of the associated IP address and the Cloudflare ASN for new registrations that resolve to the same host is recommended. Organizations should update their URL filtering and web gateway policies to deny traffic to velfacilis.cfd and any subdomains, and enforce TLS inspection to detect similar threats that might later obtain a certificate. Because the site is currently offline, evidence collection is limited to the metadata reported here; analysts should request full payload captures if the domain reappears.