cloudpuput[.]com

Analysis of the domain cloudpuput.com confirms its classification as an active credential-theft phishing site targeting users of professional IT and web design services. The domain was registered on May 19, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in phishing infrastructure. Infrastructure analysis reveals the domain resolves to IP address 104.21.60.97, which is associated with Cloudflare's content delivery network, a common tactic to obscure hosting origins and evade takedowns. The site employs a Let's Encrypt SSL certificate, providing an appearance of legitimacy while using Cloudflare and HTTP/3 technologies to enhance performance and resilience. The page title, 'Valgorix - Professional Web Design & E-commerce Solutions | London IT Services,' indicates an attempt to impersonate a legitimate IT services provider, though no specific brand abuse has been confirmed beyond this title. The domain has been flagged in 21 threat intelligence pulses on AlienVault OTX, suggesting widespread recognition of its malicious nature. Detection systems including PhishDestroy, Maltrail, and BLP-Malware have blocked the domain, and it appears on three security blocklists. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious status. While 18 of 95 security vendors on VirusTotal flag the domain as malicious, the absence of detections from the remaining vendors does not imply safety, as phishing domains often evade initial detection through rapid rotation or obfuscation. Defenders should treat this domain as high-risk and implement blocking measures at the DNS and network levels. The use of Cloudflare and a recent registration date align with common phishing tactics, and the domain's continued activity as of July 12, 2026, indicates it remains operational.