dolorumsaepe[.]cfd

The domain dolorumsaepe.cfd is currently flagged as a credential theft operation masquerading as a high-value opportunity scam. Analysis indicates the domain is presently offline, though prior activity suggests it was designed to harvest user credentials or sensitive information under false pretenses. The page title, "Не упусти возможность!" (translated: "Don’t miss the opportunity!"), reinforces the social engineering tactic of creating urgency to manipulate victims into divulging personal or financial data. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to the IP address 172.67.166.130. Despite its recent creation, the domain has already been flagged on one security blocklist, though it remains undetected by all 95 VirusTotal vendors. The site employs Cloudflare for content delivery and protection, including HTTP/3 and Cloudflare Browser Insights, which may obscure its malicious intent. The SSL certificate is issued by Google Trust Services, adding a superficial layer of legitimacy. Trust scores from independent security sources are uniformly low, with a Gridinsoft rating of 0/100, further corroborating its suspicious nature. Current status indicates the domain has been taken offline, though its infrastructure remains intact. Organizations and users are advised to proactively block the domain and its associated IP (172.67.166.130) at the network level to prevent potential re-emergence. Security teams should monitor for similar domains registered through NiceNIC or resolving to the same IP range, as these may indicate related malicious activity. End users should be educated on recognizing social engineering tactics, particularly those leveraging urgency or exclusive offers in non-Latin scripts. If credentials were entered on this domain, immediate password resets and multi-factor authentication enforcement are recommended for all associated accounts.