app[.]debirdge[.]run

Analysis of the domain app.debirdge.run indicates that it was registered through Cloudflare, Inc. and hosted on the Cloudflare network (ASN 13335) with the IP address 172.67.146.180, which geolocates to the United States. The site presented a TLS certificate issued by Google Trust Services under the WE1 designation, confirming that HTTPS was correctly provisioned at the time of observation. Technical fingerprints show the use of Cloudflare Browser Insights, Cloudflare services, and HTTP/3, all consistent with a typical Cloudflare‑fronted web presence. The page title returned by the server was "www.www.app.debirdge.run," a duplication that may be indicative of automated or misconfigured deployment but provides no additional context about the content hosted.

VirusTotal recorded three positive detections out of ninety‑five scanned security vendors, suggesting that multiple scanners identified malicious characteristics. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy remediation service. Current network measurements indicate that the domain has been taken offline, and no live HTTP response was observed during the latest probe. While the available evidence points to a phishing‑related infrastructure—supported by the generic phishing classification in the intelligence feed—no direct samples of phishing pages, credential‑stealing forms, or targeted brand information have been publicly disclosed.

Consequently, the precise lure or victim profile remains uncertain. Defenders should continue to block traffic to app.debirdge.run at perimeter controls, monitor for any re‑hosting attempts on alternative IP ranges, and maintain vigilance for related Cloudflare‑associated subdomains that may exhibit similar characteristics. Ongoing threat‑intel feeds should be consulted for updates, and any detections should be correlated with endpoint telemetry to assess potential compromise.