niggaliqiud[.]fun

Analysis as of July 24 2026 shows the domain niggaliqiud.fun is currently offline but was previously identified as a generic phishing infrastructure. The domain was registered on September 29 2025 through NiceNIC International Group Co., Limited and points to the Cloudflare‑owned IP address 172.67.221.201 (AS13335, United States). The authoritative nameservers are cora.ns.cloudflare.com and justin.ns.cloudflare.com, indicating the use of Cloudflare DNS. No TLS certificate was observed, meaning the site served HTTP only. The page title returned by the server was “Un momento…”, which provides no additional context about the targeted brand or campaign.

The domain has been blocked by the PhishDestroy sinkhole and appears on a single security blocklist. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal scans recorded 12 detections out of 95 participating AV engines, confirming that multiple commercial scanners flag the host as malicious. AlienVault OTX lists the domain in one threat‑intel pulse, further corroborating its involvement in phishing operations.

The lack of an SSL certificate, low trust score, and multiple vendor detections suggest the infrastructure was actively used for credential harvesting before being taken offline. Defenders should continue to deny any outbound connections to 172.67.221.201, add niggaliqiud.fun to local blocklists, and monitor for any resurrection of the domain or reuse of the same Cloudflare IP range. Because the underlying hosting provider is Cloudflare, any future re‑registration may inherit the same IP address; therefore, threat‑hunting rules should include the IP and its associated ASN. At present, no further details about the phishing payload, target audience, or compromised accounts are available, so analysts should treat the domain as a high‑confidence indicator of compromise and prioritize containment in environments where the domain may have been accessed.