budal24[.]net

The domain budal24.net is currently classified as a high‑risk generic phishing infrastructure and remains active as of 12 July 2026. Automated detection systems have assigned it a high risk rating, and it appears on at least one external blocklist. The site returns an HTTP 403 response and the page title is limited to “Just a moment…”, which is commonly observed in malicious hosting environments.

Registration data shows the domain was created on 27 May 2026 through a widely used commercial registrar, and it is served by nameservers ali.ns.cloudflare.com and brett.ns.cloudflare.com, indicating the use of a major content delivery network for DNS resolution. The domain resolves to the IPv4 address 172.66.174.172, which is associated with a cloud services provider located in Canada. TLS is enabled with a certificate issued by a publicly trusted certificate authority, demonstrating an attempt to present a legitimate‑looking HTTPS endpoint.

Reputation analysis reveals a trust score of zero out of one hundred from a known scoring engine, reflecting extreme suspicion. Two out of ninety‑five security vendors on a multi‑engine scanning platform have flagged the domain, providing independent confirmation of malicious intent. The combination of a newly created domain, low trust score, minimal vendor detections, and active blocklist status suggests a coordinated phishing campaign rather than an isolated misconfiguration.

Defenders should prioritize immediate containment by adding budal24.net to network and endpoint blocklists and by configuring DNS filters to deny any resolution attempts. Continuous monitoring of the associated IP address and the two Cloudflare nameservers is advised to detect potential pivoting or replication of the infrastructure. Incident response teams should also scrutinize any authentication attempts that reference the domain and treat related traffic as compromised until further forensic evidence clarifies the payload.