virduda[.]cfd

The domain virduda.cfd was registered on June 17, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently taken offline. DNS resolution points to the IP address 172.67.193.231, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The authoritative nameservers athena.ns.cloudflare.com and felipe.ns.cloudflare.com confirm that the domain is hosted behind Cloudflare’s edge network, a pattern commonly observed in malicious campaigns that leverage the provider’s global infrastructure to obscure origin. Security telemetry shows that the domain appears on a single blocklist and is explicitly listed by PhishDestroy, indicating that at least one anti‑phishing service has taken action against it.

VirusTotal analysis records 11 detections out of 91 security vendors, reflecting a moderate level of consensus among scanners that the domain is malicious. The Gridinsoft trust score of 0 out of 100 further reinforces its classification as unsafe. SSL inspection reveals a valid certificate issued by Google Trust Services under the WE1 umbrella, demonstrating that the operator obtained a legitimate TLS certificate, a tactic often used to increase user trust despite underlying fraudulent intent.

While the site is no longer reachable, the historical evidence—recent registration, Cloudflare‑hosted IP, blocklist inclusion, multiple vendor detections, and a zero‑trust score—supports the conclusion that virduda.cfd was employed for generic phishing activity. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host or related subdomains, and consider adding the IP to reputation lists. Ongoing observation of the registrar’s activity and any future DNS changes is advisable, as threat actors frequently repurpose short‑lived domains in similar campaigns.