neudkb[.]app

This domain neudkb.app is currently offline but exhibits multiple indicators of a brand‑impersonation campaign. The authoritative name servers are kristina.ns.cloudflare.com and pablo.ns.cloudflare.com, confirming that the domain is registered through Cloudflare, Inc. DNS resolution points to the IP address 104.21.39.179, which belongs to AS13335 operated by Cloudflare in the United States. The web server presents a Cloudflare edge with HTTP/3 support and returns an HTTP 403 status code, while the presented TLS certificate is issued by Google Trust Services under the WE1 designation, indicating a valid public‑trusted certificate. The page title returned from the host is “Thomas Weber Photography”, yet the threat metadata lists the impersonated brand as “across”, suggesting the site is being used to lure victims under the guise of that brand.

The domain appears on one security blocklist and is explicitly blocked by PhishDestroy. Threat intelligence aggregators have recorded activity: AlienVault OTX includes the domain in 15 separate pulses, and VirusTotal reports 16 of 95 scanning engines flagging it as malicious. These detections together raise the risk rating to elevated.

Because the site is offline, direct content analysis is not possible, and the exact phishing payload or credential‑capture mechanisms remain unknown. Defenders should continue to monitor the domain’s DNS and IP address for any reactivation, enforce blocklists that include neudkb.app, and update URL filtering rules to deny traffic to the associated IP range. Additional verification of the “across” brand impersonation can be pursued by correlating user reports of suspicious communications that reference the brand and by inspecting any future HTTP 200 responses should the domain become active again.