salodecuba[.]vip

Analysis of the domain salodecuba.vip shows a high‑risk, active phishing infrastructure that was created on February 23 2026 and is currently serving a page titled “Attention Required! | Cloudflare”. The domain resolves to the Cloudflare edge address 104.21.33.176, belonging to AS13335 (Cloudflare, Inc.) and is located in the United States. DNS is delegated to jerome.ns.cloudflare.com and aryanna.ns.cloudflare.com, confirming that the domain is fully protected by Cloudflare services, including HSTS, HTTP/3, and Cloudflare Browser Insights. The site presents an HTTP 307 redirect, which is typical for traffic steering used by phishing kits.

The SSL certificate is issued by Let’s Encrypt (E8), indicating a valid TLS configuration but offering no assurance of legitimacy. Security telemetry shows that the domain appears on one blocklist and is explicitly blocked by PhishDestroy. VirusTotal reports a single positive detection out of 93 scanning engines, reinforcing the malicious classification. Independent reputation scoring from Gridinsoft assigns a trust score of 0 / 100, reflecting an extremely low confidence level. The phishing kit identified is the “Airdrop Scam” kit, a known template used to lure victims with fraudulent cryptocurrency giveaway promises.

Registration was performed through NiceNIC International Group Co., Limited, a registrar that has been associated with other short‑lived malicious domains. While the exact content of the landing page has not been publicly disclosed, the presence of a Cloudflare challenge page suggests the operators are using Cloudflare’s protection to evade automated analysis. Defenders should immediately block the domain at perimeter firewalls, update URL filtering policies, and add the IP address 104.21.33.176 to any network‑wide deny lists. Continuous monitoring of the associated ASN and related subdomains is advised, as Cloudflare‑hosted infrastructure can be rapidly repurposed for additional campaigns.