asfenaqn[.]cfd

Analysis indicates that asfenaqn.cfd was registered on November 20, 2025 through Web Commerce Communications Limited and delegated to Cloudflare nameservers carlos.ns.cloudflare.com and maya.ns.cloudflare.com. The domain resolves to IP 104.21.60.167, which is owned by AS13335 Cloudflare, Inc., and is geolocated to the United States. No TLS certificate is presented; attempts to establish an HTTPS connection return a 525 SSL handshake failed page title, confirming that the server does not complete the TLS handshake. The site was identified as using the Airdrop Scam phishing kit, a known template that lures victims with promises of cryptocurrency airdrops.

Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. VirusTotal scans show that eight of ninety‑five security vendors flagged the domain, and it appears on a single blocklist, PhishDestroy, confirming that at least one reputable sinkhole has listed it as malicious. The current operational status is offline, indicating that the hosting has been taken down, but the infrastructure components remain observable. Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, especially given its recent creation date and association with an active phishing kit.

Monitoring of the underlying Cloudflare IP range for any re‑use of the same address is advisable, as threat actors frequently recycle Cloudflare endpoints. Because the site does not present a valid SSL certificate, any attempt to load it over HTTPS will fail, but attackers may still serve content over HTTP; therefore, outbound HTTP traffic to the domain should be denied. Threat intelligence platforms should ingest the registrar, nameserver, and IP metadata to enrich correlation rules, and incident response teams should treat any emails or messages referencing airdrop offers from this domain as malicious.