grdtrack[.]cfd

This domain, grdtrack.cfd, is flagged for elevated-risk credential theft activity targeting users through fraudulent shipping tracking interfaces. Analysis indicates the site masquerades as a legitimate parcel tracking service under the page title 'Tracking Number Check,' a common tactic to harvest login credentials, payment details, or personal data from unsuspecting victims. Infrastructure analysis reveals the domain was registered on October 13, 2025, through Web Commerce Communications Limited, a registrar frequently associated with malicious domains. It resolves to the IPv6 address 2a06:98c1:3121::3 and employs Cloudflare services, including Cloudflare Browser Insights and HTTP/3, to obfuscate its origin and evade detection. Detection metrics show 4 out of 95 security vendors on VirusTotal flagged the domain, while AlienVault OTX lists it in one threat intelligence pulse. The domain appears on a single security blocklist and has been assigned a trust score of 0/100 by Gridinsoft. The SSL certificate is issued by Google Trust Services, which, while not inherently malicious, is often leveraged by threat actors to lend false legitimacy to phishing sites. To mitigate the risk posed by this credential theft campaign, organizations and individuals should implement the following measures. First, block the domain grdtrack.cfd and its associated IP address 2a06:98c1:3121::3 at the network perimeter. Second, deploy browser-based warnings or extensions that alert users to known credential theft domains, particularly those impersonating shipping or logistics services. Third, conduct user awareness training to educate employees and end-users on identifying fraudulent tracking pages, such as scrutinizing domain names for misspellings or unusual top-level domains (e.g., .cfd). Finally, monitor for unusual login attempts or data exfiltration patterns that may indicate successful credential harvesting from this or similar campaigns.