banditcump[.]com

The domain banditcump.com was observed on July 12, 2026 delivering a generic phishing payload. HTTP requests return a 200 status code while the page title reports “522: Connection timed out”, indicating a Cloudflare‑hosted front end that is actively refusing connections. The site is classified as high‑risk and remains active at the time of analysis. Infrastructure analysis shows the domain resolves to the IP address 172.67.191.76, which belongs to the AS13335 network operated by Cloudflare, Inc. The domain employs Cloudflare’s DNS services, using the authoritative nameservers alex.ns.cloudflare.com and khloe.ns.cloudflare.com. TLS termination is provided by a certificate issued by Google Trust Services under the WE1 root, confirming the use of industry‑standard encryption. The domain was registered on March 13, 2026 through NiceNIC International Group Co., Limited, a registrar that does not appear on any known abuse‑free list. Threat intelligence sources have flagged the domain on a single security blocklist and PhishDestroy has actively blocked it. The Gridinsoft trust score is 0 out of 100, reflecting a complete lack of trust. VirusTotal reports that 3 of 95 scanned security vendors have marked the domain as malicious, reinforcing the phishing designation. The combination of a fresh registration, low trust score, and multiple detections aligns with typical patterns of newly created phishing infrastructure. Uncertainty remains regarding the specific credential‑stealing page or target brand, as the site currently serves only a timeout page and no payload content could be captured. Defenders should add the IP 172.67.191.76 and the domain banditcump.com to outbound and inbound block lists, monitor DNS queries for the associated Cloudflare nameservers, and enforce URL filtering for all connections to the domain. Continuous re‑assessment is advised, given the active status and the possibility of future payload deployment.