dfvvg[.]christmas

Analysis as of July 28, 2026 indicates that the domain dfvvg.christmas was registered on June 18, 2026 through the registrar Spaceship, Inc. The domain uses the authoritative name servers launch1.spaceship.net and launch2.spaceship.net, both associated with the same registrar. DNS resolution points to the IPv4 address 47.242.217.10, which remains active at the time of assessment. VirusTotal has recorded detections from seven of ninety‑one scanned security vendors, confirming that multiple detection engines flag the domain as malicious. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service, reinforcing its classification as a high‑risk phishing infrastructure.

The current operational status is listed as active, and no evidence of takedown or remediation has been observed. The available data do not include SSL certificate details, HTTP response codes, page title, or any observed payloads, leaving the exact phishing landing page content unverified. Consequently, the specific phishing campaign vector, target brand, or credential‑harvesting technique cannot be confirmed at this stage.

Defenders should treat the domain as hostile, enforce network‑level deny rules for the IP address 47.242.217.10, and incorporate the domain into URL filtering and email security policies. Monitoring of the associated name servers and blocklist status is recommended to detect any future changes in hosting or mitigation actions. Given the recent registration date and multiple vendor detections, the domain poses a high likelihood of being used in credential‑stealing operations targeting unsuspecting users.