ndtipl[.]cc

The domain ndtipl.cc was registered through NameCheap, Inc. on February 21, 2026 and remains active. DNS resolution points to 104.18.27.248, an address owned by AS13335 Cloudflare, Inc., located in the United States. The authoritative nameservers are ada.ns.cloudflare.com and syeef.ns.cloudflare.com, both indicating the use of Cloudflare’s DNS and CDN services. An SSL certificate issued by Google Trust Services (WE1) secures the site, and HTTP / 3 delivery is observed.

When accessed, the site returns HTTP 200 and presents a page titled "NDTIPL.COM". Technical fingerprinting reveals the presence of Google Sign‑in integration, a Vue.js front‑end framework, and Alibaba Cloud Object Storage Service, alongside enforced HSTS. These components suggest a deliberately constructed credential‑harvesting page that mimics legitimate login flows.

Threat intelligence platforms have flagged the domain as high‑risk. VirusTotal reports 15 out of 95 security vendors flagging the domain, and Gridinsoft assigns a trust score of 1 out of 100. The domain is listed on one public blocklist and has been actively blocked by PhishDestroy. The combination of recent creation, active hosting, a low trust score, and multiple security vendor detections supports a classification of generic phishing.

Defenders should add ndtipl.cc to DNS and URL filtering rules to prevent user access. Email security gateways should be updated to block messages containing links or references to this domain. Continuous monitoring of Cloudflare‑associated IP ranges for similar activity, along with periodic re‑scanning on VirusTotal or comparable services, will help detect any evolution of the infrastructure.