id[.]businesspageusecontact[.]cfd

On July 24, 2026, id.businesspageusecontact.cfd was observed being used for a brand‑impersonation campaign targeting the generic “across” brand. The domain was registered through Atak Domain on 14 November 2025 and is hosted on Cloudflare infrastructure (ASN 13335) with the public IP address 188.114.97.3 located in the United States. DNS resolution is provided by four Cloudflare name servers: brian.ns.cloudflare.com, delilah.ns.cloudflare.com, jacqueline.ns.cloudflare.com, and an additional unnamed server. No TLS certificate is presented for the site, indicating that HTTPS was not enabled at the time of analysis. The page title returned by the HTTP response is “Furniture Next App – Somor Mk”, which does not reference the impersonated brand and suggests a possible content‑cloaking technique.

The domain appears on a single security blocklist and has been flagged by PhishDestroy as a malicious resource. A trust score from Gridinsoft rates the domain at 0 out of 100, reflecting extreme risk. VirusTotal analysis shows 16 of 95 security vendors label the domain as malicious, reinforcing the suspicion of active abuse. Current HTTP status indicates the site has been taken offline, and no SSL certificate is in place. However, the historical evidence of multiple vendor detections, blocklist inclusion, and a zero‑trust score demonstrates that the domain was previously used for phishing or credential‑harvesting activity.

The precise payload, phishing kit, or victim interaction flow remains unknown because the site is no longer reachable for content inspection. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the hostname, and add the associated IP address 188.114.97.3 to threat‑intel feeds. Ongoing observation of Cloudflare‑hosted infrastructure associated with this ASN is advised, as threat actors frequently recycle IP ranges.