freedaily2invest[.]org

The domain freedaily2invest.org was registered on 21 April 2026 and is currently resolving to the IP address 135.125.155.64, which belongs to OVH GmbH in Germany. Authoritative name servers are ns1.cloudoon.com, ns2.cloudoon.net and ns3.cloudoon.org, indicating use of the cloudoon hosting platform. The site presents an HTTPS certificate from Let’s Encrypt (R13) and returns an HTTP 302 redirect on request, suggesting a staged delivery of malicious content. The page title returned is “OLITT”, and analysis links the site to an “Airdrop Scam” phishing kit. Threat intelligence shows the domain appears in a single AlienVault OTX pulse, has a Gridinsoft trust score of 0 / 100, and is listed on one public blocklist. VirusTotal records a single positive detection out of 94 scanners. The domain is actively blocked by PhishDestroy, confirming its classification as a high‑risk phishing host. Evidence does not reveal the exact payload or victim interaction flow, and no additional corroborating samples have been observed beyond the initial kit attribution. Defenders should add the IP address and the three cloudoon name servers to outbound filtering rules, enforce DNS blocklisting of the domain, and monitor for any HTTP 3 traffic patterns that may indicate exploitation of the observed protocol support. Continuous re‑scanning with multi‑engine services is advised to capture any evolving indicators.