budgetingcs[.]com

Analysis of budgetingcs.com, registered through NiceNIC International Group Co., Limited on February 21, 2026, shows a high‑risk phishing infrastructure. The site resolves to IP 172.67.220.152, a Cloudflare‑owned address (AS13335, United States). DNS is served by christian.ns.cloudflare.com and irma.ns.cloudflare.com, and the domain presents a valid TLS certificate issued by Google Trust Services under the WE1 label, indicating proper HTTPS termination but not validating the underlying content. An HTTP request returns status 200, and the page title is exactly "budgetingcs", providing no further indication of the payload.

Automated scanning by VirusTotal recorded two positive detections out of 93 security vendors, confirming malicious behavior despite a low detection count. Independent blocklist monitoring shows the domain appears on one security blocklist, and PhishDestroy has already blocked it, reinforcing the phishing classification. Technical fingerprinting reveals a WordPress front‑end backed by MySQL and PHP, with client‑side libraries including jQuery, jQuery Migrate, and the live‑chat widget Olark. Cloudflare’s HTTP/3 support and CDN services are active, which can obscure origin server details.

The Gridinsoft trust score is 0 out of 100, reflecting a lack of trustworthiness. While the exact phishing campaign content (e.g., credential‑stealing forms, lure page) has not been publicly disclosed, the combination of a recently created domain, low trust score, positive vendor detections, and active blocklist listings indicates a live phishing operation. defenders should block both the domain and its resolving IP at perimeter firewalls, add the nameservers to DNS filtering lists, and monitor for any related C2 patterns tied to the Cloudflare edge.