giftfreecp[.]top

giftfreecp.top is an inactive credential-phishing site that presented a login page titled “LOGIN – CALL OF DUTY®”. The domain was registered on 2025-10-02 through Web Commerce Communications Ltd and uses the authoritative nameservers s11.rubihost.ir and s12.rubihost.ir. DNS resolution points to the IPv4 address 190.2.143.208, which belongs to AS49981 WorldStream B.V. and is geolocated in the Netherlands. The site served a Let’s Encrypt certificate (issuer “Let’s Encrypt / YR1”), indicating that TLS was correctly configured at the time of operation.

Multiple security feeds have flagged the domain: PhishDestroy listed it as blocked, a single security blocklist also contains the host, and AlienVault OTX includes it in one threat‑intelligence pulse. VirusTotal scans recorded 21 of 91 anti‑malware engines flagging the domain as malicious. The unique seed 3f56b1 ties this observation to a broader campaign of generic phishing targeting gaming credentials. Because the site is currently taken offline, active exploitation cannot be confirmed, but the presence of a legitimate‑looking login title suggests an attempt to harvest Call of Duty account details.

Defenders should continue to monitor the IP address 190.2.143.208 for any re‑use, enforce outbound filtering for the domain and related C2 patterns, and update URL blocklists with the domain and its nameservers. Organizations using Call of Duty services should advise users to verify URLs and enable multi‑factor authentication where possible. Further investigation is required to retrieve the exact HTTP response codes and any payload delivered before takedown, as those details were not captured in the available intelligence.