mk1[.]bangjanggal[.]cfd

mk1.bangjanggal.cfd was observed serving HTTP content with a 200 response and a valid TLS certificate issued by Google Trust Services under the WE1 designation. The page title returned is “bangjanggal.cfd”, matching the registered second‑level domain. Automated classification tools have assigned it a generic_phishing label and a high risk rating, consistent with the observed behavior of credential‑stealing pages. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3, which is owned by Cloudflare, Inc. and geolocated to Canada. The authoritative name servers are ezra.ns.cloudflare.com and stevie.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. Registration data indicates the domain was created on 15 May 2026 through Dynadot LLC, and no additional sub‑domains have been linked to the same registrar in public records. Threat intelligence sources report that the domain has a Gridinsoft trust score of 0 out of 100, and only one of ninety‑five security vendors on VirusTotal flagged the site, suggesting limited detection coverage. Nonetheless, the domain appears on a single security blocklist and is actively blocked by PhishDestroy, confirming its use in malicious campaigns. The combination of a fresh registration, Cloudflare front‑end, and low reputation metrics aligns with typical phishing infrastructure employed to evade rapid takedown. Defenders should incorporate mk1.bangjanggal.cfd into URL filtering and DNS block lists, and monitor for any resolution to the associated Cloudflare IP. Given the active HTTPS service, TLS interception may be required for payload inspection. Continuous re‑evaluation is advised, as the low vendor flag count may change if additional analyses surface. Incident response teams encountering credential submission to this domain should treat any harvested data as compromised and advise affected users to reset credentials.