aduiywbd[.]com

Analysis indicates that aduiywbd.com is an active credential phishing domain targeting users of the telecommunications provider referenced in its page title, 'Sign in with your Telstra ID'. The domain was registered on September 9, 2025, through Sav.com, LLC, and currently resolves to IP address 172.93.103.197, hosted on AS23470 (ReliableSite.Net LLC) in the United States. No SSL certificate is present, increasing the risk of unencrypted credential interception. Infrastructure analysis reveals Cloudflare nameservers (augustus.ns.cloudflare.com, laura.ns.cloudflare.com), which are commonly used to obscure hosting origins and evade takedowns. The domain is flagged by 15 of 93 security vendors in aggregated threat intelligence, with detection labels including generic phishing. It appears on two security blocklists and has been documented in 15 threat intelligence pulses, suggesting sustained malicious activity. MX records point to Google’s mail servers, which may indicate an attempt to legitimize the domain for email-based phishing campaigns or to receive stolen credentials via SMTP. Defenders should note that the domain remains active as of July 13, 2026, with an HTTP 200 status code, confirming operational phishing infrastructure. The absence of SSL, combined with the use of Cloudflare and a hosting provider known for bulletproof services, aligns with tactics observed in high-risk phishing operations. Organizations are advised to block the domain and IP at perimeter defenses, monitor for credential reuse attempts, and review logs for connections to 172.93.103.197 or related subdomains. Further investigation into associated email campaigns or linked infrastructure may reveal broader targeting patterns.