cf[.]780411[.]xyz

Analysis of cf.780411.xyz as of 2026‑08‑04 shows that the domain is actively used for generic phishing. The site is listed on two public blocklists and is blocked by the PhishDestroy and OpenPhish monitoring services. Google Safe Browsing categorises the URL under social engineering, confirming its intent to deceive users. VirusTotal scans have returned 15 positive detections out of 91 submitted security vendors, indicating a consensus among multiple AV engines that the domain hosts malicious activity.

The high risk rating aligns with the detection density and the presence on reputable phishing feeds. No additional infrastructure details such as registrar information, IP address, hosting provider, SSL certificate data, or HTTP response codes have been disclosed in the current intelligence set, leaving the underlying infrastructure opaque. Consequently, defenders cannot attribute the domain to a specific campaign infrastructure or identify any shared infrastructure with other malicious actors. Given the confirmed blocklist presence and the multi‑vendor detections, security teams should deny network traffic to cf.780411.xyz at perimeter and endpoint layers.

Email gateways should enforce URL filtering rules that include the domain in block lists. Incident response teams should monitor for any internal logs indicating connections to the domain and quarantine affected endpoints. Continuous monitoring of threat intel feeds for new indicators related to this domain is advised, as further details may emerge that clarify its hosting environment or payload delivery mechanisms.