caefjbd[.]pilot45[.]com

Analysis of caefjbd.pilot45.com shows that the domain was created on 23 December 2024 and is currently taken offline. The site resolves to 104.21.2.72, an address owned by Cloudflare, Inc. (AS13335) and is hosted in the United States. DNS resolution uses the Cloudflare nameservers aron.ns.cloudflare.com and titan.ns.cloudflare.com, indicating the attacker leveraged Cloudflare’s CDN and proxy services to hide the true origin of the traffic. Registration was performed through Gname.com Pte. Ltd., a registrar known to host a variety of malicious domains. No TLS certificate is present, so the site would have been served over HTTP only, a characteristic often observed in low‑cost phishing deployments.

The only visible page element is the title “网站筹建中”, which translates to “website under construction”, providing no functional content for verification. VirusTotal recorded 15 detections out of 95 scanned vendors, confirming that multiple security engines flag the domain as malicious. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy sinkhole, indicating that at least one defensive network has intercepted traffic to the site. Scamadviser assigns a trust score of 1 out of 100, reinforcing the assessment of high risk.

The combination of recent registration, Cloudflare‑based hosting, lack of encryption, and multiple vendor detections points to a deliberately crafted phishing infrastructure. Uncertainty remains regarding the specific phishing payload, target audience, or any credential‑harvesting pages, as the site content has not been captured before takedown. Defenders should continue to block the domain at network perimeters, monitor for any resurgence of the same IP or nameserver pair, and update URL filtering rules to include the observed host. Incident response teams should also consider querying historical archives for snapshots of the site to extract possible malicious forms or lure templates for further attribution.