cvsxzaonu[.]cfd

The domain cvsxzaonu.cfd has been identified as a generic phishing threat, currently active and posing a high risk to users. The site presents itself under the title "Página de inicio - Logística global y envíos internacionales España," suggesting it is impersonating a global logistics and international shipping company based in Spain. While no specific brand or drainer kit has been attributed to this campaign, the phishing nature is clear from its deceptive appearance and lack of legitimate security measures.

Technical indicators paint a concerning picture. VirusTotal analysis shows 13 out of 95 security vendors flagging this domain as malicious, representing a significant detection rate. The domain resolves to IP address 43.160.194.46 and was registered through Aceville Pte. Ltd., a registrar sometimes associated with suspicious domains. Its creation date is October 23, 2025, making it a very recent threat. The site lacks an SSL certificate, meaning any data transmitted is unencrypted and vulnerable to interception. Additionally, the domain appears on one security blocklist and has been found in one threat intelligence pulse on AlienVault OTX, indicating active monitoring by the security community.

As of the latest check, the phishing site remains active and accessible, continuing to pose a risk to visitors. No response actions have been observed, and the domain's registrar has not taken it down. Users should avoid interacting with cvsxzaonu.cfd entirely, as it may attempt to harvest login credentials, personal information, or financial data under the guise of legitimate shipping services. PhishDestroy recommends blocking this domain at the network level and educating users about the risks of unsolicited logistics-related communications. If you have already visited the site, change any passwords used and monitor accounts for suspicious activity.