ffixdflt[.]cm

Analysis indicates that the domain ffixdflt.cm was registered on August 17, 2025 through Netcom.cm Sarl and is currently resolved to the IP address 95.129.234.38, which belongs to AS57724 DDOS‑GUARD LTD in Russia. The domain is protected by Cloudflare’s DNS service (edna.ns.cloudflare.com, porter.ns.cloudflare.com) and serves content over HTTP/3, suggesting the use of modern transport protocols. The SSL certificate is issued by Google Trust Services under the WE1 designation, providing a valid TLS handshake despite the site being offline. A scan on VirusTotal recorded 11 positive detections out of 95 security vendors, confirming that multiple scanners flag the domain as malicious.

Independent reputation services show low confidence: Scamadviser assigns a trust score of 36 / 100 while Gridinsoft rates it at 0 / 100. The site presently returns a generic “404 Error” page title, indicating that the landing page is inaccessible or removed. The domain appears on a single known blocklist and is actively blocked by the PhishDestroy service, reinforcing its classification as a phishing‑related resource. The presence of YouTube technology suggests that the site may have previously embedded video content, a technique sometimes used to lure victims.

However, without live content the exact phishing payload or targeted brand cannot be confirmed. Defenders should continue to block the domain at perimeter filters, update URL‑allow lists to include the associated IP and nameserver entries, and monitor for any re‑appearance of the host. Additional investigation of historical snapshots and traffic logs may reveal the specific credential‑harvesting tactics employed before the takedown.