lofip[.]cfd

The domain lofip.cfd was registered on 2025-11-07 through Web Commerce Communications Limited and is hosted on Cloudflare (AS13335) with the IP address 104.21.1.66 located in the United States. The domain uses the Cloudflare nameservers bryce.ns.cloudflare.com and mona.ns.cloudflare.com and does not present an SSL/TLS certificate, meaning connections are not encrypted. VirusTotal reports that five of ninety‑five scanning engines have flagged the domain, indicating partial detection by security vendors. Independent blocklist monitoring shows the domain listed on two public blocklists, specifically PhishDestroy and Enkrypt, which further confirms malicious use.

Gridinsoft assigns a trust score of zero out of one hundred, reflecting a complete lack of confidence in the domain’s legitimacy. The site is currently taken offline, and its HTTP status is not observable. The only declared malicious behavior is a brand‑impersonation campaign targeting the backpack brand, as indicated by the intelligence source. Evidence from the page title or content has not been released, so the exact appearance of the counterfeit page cannot be verified.

Safe Browsing checks are not reported, and no Open Threat Exchange (OTX) entries have been linked to the domain, leaving those vectors unconfirmed. No phishing kit or additional payload information has been disclosed, so operational details remain uncertain. Defenders should continue to block the IP 104.21.1.66 and the domain lofip.cfd at DNS and proxy layers, monitor for any re‑registration attempts, and update intrusion‑detection signatures to reflect the observed host and name‑server configuration. Continuous monitoring of the associated IP range and Cloudflare edge nodes is recommended, as adversaries frequently rotate sub‑domains behind the same infrastructure.