2824i[.]com

This domain, 2824i.com, is currently active and has been identified as a high‑risk generic phishing site. The authoritative name servers are jihoon.ns.cloudflare.com and meera.ns.cloudflare.com, indicating the use of Cloudflare DNS infrastructure. Registration records show that the domain was created on June 25 2018 through Name.com, Inc., and no recent re‑registration activity has been observed. DNS resolution points to the IPv4 address 144.48.223.79; no additional A or AAAA records were found in public lookups. Threat intelligence aggregators list the domain on a single security blocklist, and PhishDestroy has explicitly blocked it.

VirusTotal analysis shows that 12 of 91 scanning engines flag the domain as malicious, which aligns with the high‑risk rating. No public SSL certificate details, HTTP status codes, page titles, or Safe Browsing verdicts are available, leaving the content of the hosted site unverified. The absence of such telemetry means that definitive conclusions about the lure or credential‑harvesting mechanisms cannot be drawn at this time. Defenders should therefore treat any traffic to 2824i.com as suspicious.

Recommended actions include adding the domain to outbound DNS blocklists, updating firewall deny rules for the IP 144.48.223.79, and monitoring for any anomalous connections from internal hosts. Continuous re‑scanning on VirusTotal and periodic checks of Cloudflare DNS records are advised to capture any infrastructure changes. Organizations employing email filtering should ensure that messages containing links to this domain are quarantined. Given the existing vendor detections and the active blocklist entry, a proactive blocking stance is justified while further forensic analysis of the site content is pursued.