adjara-gudju1[.]cfd

This domain, adjara-gudju1.cfd, is flagged as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates an elevated risk level due to its active exploitation of trusted infrastructure and confirmed malicious classification by multiple security entities. The domain is designed to mimic legitimate services, tricking users into submitting sensitive credentials such as usernames, passwords, and potentially multi-factor authentication codes. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.67.141.155 and was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It employs Cloudflare Browser Insights and Cloudflare’s content delivery network, including HTTP/3 support, while using an SSL certificate issued by Google Trust Services. The domain appears on one security blocklist and is flagged by 6 out of 95 security vendors on VirusTotal. Additionally, it has been assigned a trust score of 0/100, further confirming its malicious nature. The page title, 'Twilight Coder — Results,' suggests an attempt to appear as a legitimate service or tool, likely to deceive users into interacting with the phishing interface. Mitigation steps for this specific threat include immediate blocking of the domain and its associated IP address (172.67.141.155) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to adjara-gudju1.cfd and monitor for any attempts to visit the domain within their networks. Users who may have interacted with the site should be instructed to reset credentials for any accounts accessed during the potential exposure window. Security teams should also review logs for connections to the domain or its IP address to identify compromised accounts. Given the use of Cloudflare, additional scrutiny of domains leveraging similar infrastructure is recommended to detect related phishing campaigns.