ullamsunt[.]cfd

Analysis of the domain ullamsunt.cfd indicates it was active as a generic phishing site targeting Russian-speaking users with a fraudulent sponsor giveaway scheme. The domain was registered on November 27, 2025, through NiceNIC International Group Co., Limited, and resolved to the IP address 104.21.48.62, hosted on Cloudflare's infrastructure (AS13335). No SSL certificate was detected, increasing the risk of unencrypted data transmission. The page title, 'Крепнейшая раздача от спонсоров' (translated as 'Strongest Giveaway from Sponsors'), suggests an attempt to lure victims with promises of rewards or prizes, a common tactic in phishing campaigns.

As of July 24, 2026, the domain is offline, though its prior activity was flagged by 6 of 95 security vendors on VirusTotal, and it appears on at least one security blocklist, including PhishDestroy. The use of Cloudflare nameservers (rachel.ns.cloudflare.com and simon.ns.cloudflare.com) is consistent with phishing infrastructure, as threat actors often leverage Cloudflare's services to obscure hosting details and evade takedowns. Gridinsoft assigned the domain a trust score of 0/100, further indicating malicious intent. While the exact brand or organization being impersonated is not confirmed in the available data, the page title implies a focus on fake sponsorship or promotional offers.

Defenders should treat this domain as part of a broader phishing campaign targeting users with deceptive giveaways. Network-level blocking of 104.21.48.62 and monitoring for related domains registered through NiceNIC or using Cloudflare hosting may help mitigate similar threats. Given the domain's current offline status, no immediate user interaction is expected, but historical logs should be reviewed for prior exposure.