gift2gift[.]cfd

PhishDestroy identifies an active credential theft campaign tied to the domain gift2gift.cfd, currently under investigation with a dynamic risk classification. This malicious resource masquerades as a reputable gift exchange platform to harvest sensitive login credentials, email addresses, and potentially cryptocurrency wallet access. This domain was flagged during routine threat analysis with the following technical indicators: VirusTotal currently reports zero detections out of 95 scanners, suggesting low antivirus coverage; registration occurred on May 17, 2026 via Global Domain Group LLC; the domain resolves to the IP address 188.114.97.3, which is associated with Let's Encrypt-issued SSL certificates. The infrastructure has not yet been identified on major threat intelligence blocklists such as AlienVault OTX or Abuse.ch URLHaus. Domain reputation scores remain neutral due to its recent creation and limited historical telemetry, increasing the risk of detection evasion. To mitigate exposure to this credential theft campaign, organizations and individuals should block the domain gift2gift.cfd and monitor for any connections to the IP 188.114.97.3 at the network perimeter. Users are advised to enable multi-factor authentication (MFA) on all accounts, avoid entering credentials on unfamiliar domains, and validate any links claiming to offer gift exchange services through official channels. Security teams should deploy DNS filtering rules and inspect historical DNS logs for lateral movement. Given the zero-detection status on VirusTotal, manual verification and user awareness training are critical to prevent successful credential harvesting.