xdbdp[.]cfd

Analysis of the domain xdbdp.cfd indicates a confirmed phishing infrastructure targeting Google users through a tech-support scam. The domain was registered on September 3, 2025, via NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in fraudulent campaigns. Infrastructure analysis reveals the domain resolves to the IP address 172.67.131.24, hosted under AS13335 (Cloudflare, Inc.) in the United States. This hosting provider is commonly leveraged by threat actors to obfuscate the origin of malicious traffic and evade takedown efforts. The SSL certificate associated with the domain is issued by WE1, a provider often utilized in low-reputation or transient phishing sites.

As of July 25, 2026, the domain has been flagged by 11 of 93 security vendors on VirusTotal, a detection rate consistent with confirmed phishing activity. It appears on at least one security blocklist and is actively blocked by PhishDestroy, a specialized anti-phishing service. Gridinsoft assigns the domain a trust score of 0/100, further corroborating its malicious classification. The domain is explicitly identified as impersonating Google, aligning with the reported scam type of tech-support fraud. No page title or additional content metadata is available, limiting further analysis of the specific deception tactics employed.

The domain has since been taken offline, though its infrastructure components—such as the registrar, hosting provider, and SSL issuer—remain consistent with known phishing operations. Defenders are advised to treat any residual DNS records, SSL certificates, or associated IPs as indicators of compromise (IOCs). Organizations should update blocklists to include the domain and its resolving IP, and monitor for re-registration under similar naming conventions or registrars. Given the elevated risk level and confirmed brand impersonation, user education on recognizing tech-support scams is recommended, particularly for those interacting with Google services.