andafbit[.]com

The domain andafbit.com has been identified as a generic phishing threat, currently taken offline after being flagged by multiple security sources. This domain was created on April 26, 2026, through Name SRS AB, and resolves to IP address 104.21.45.253. Its page title was found to be "FACKJX," which appears to be a random string, suggesting the domain may have been used for temporary phishing campaigns. The SSL certificate was issued by Let's Encrypt (E7), a common choice for malicious domains due to its free and automated issuance.

According to threat intelligence, andafbit.com was flagged by 6 out of 95 VirusTotal security vendors, indicating a moderate detection rate among antivirus engines. It appeared on three security blocklists and was found in one AlienVault OTX threat intelligence pulse. The domain's connection to IP 104.21.45.253, which is associated with Cloudflare, suggests the attackers used CDN services to obfuscate their hosting infrastructure. Despite being offline now, the domain remains a risk as it could be reactivated or used for similar attacks in the future.

Given the generic phishing nature of andafbit.com, users who may have interacted with it should be cautious. PhishDestroy recommends monitoring for any associated email or credential theft. Even though the domain is offline, the attacker may have already harvested sensitive information. Users should verify any communications referencing this domain and avoid clicking on suspicious links. If credentials were entered, change them immediately and enable multi-factor authentication. PhishDestroy continues to track this threat and updates its database with new indicators as they emerge.