privetstvennyy-bonus[.]cfd

Analysis of privetstvennyy-bonus.cfd shows a domain that was created on July 23, 2026 and is currently active. The domain resolves to the IPv4 address 185.115.33.18 and was registered through Spaceship, Inc., with authoritative nameservers launch1.spaceship.net and launch2.spaceship.net. The infrastructure has already been listed on at least one public blocklist and is actively blocked by the PhishDestroy feed, indicating that threat‑intel communities have observed malicious use.

VirusTotal records indicate that the domain was scanned by 91 antivirus engines, none of which raised a detection at the time of the scan; this lack of alerts does not imply safety and may simply reflect the early stage of the campaign or effective evasion techniques. No additional telemetry such as Safe Browsing verdicts, Open Threat Exchange entries, SSL certificate details, HTTP status codes, or page‑title metadata is presently available, limiting the depth of the technical profile. Consequently, the exact phishing lure, targeted brands, or credential‑stealing mechanisms remain uncertain.

Defenders should proactively add privetstvennyy-bonus.cfd and its IP address 185.115.33.18 to outbound and inbound filtering rules, enforce strict email authentication (DMARC, SPF, DKIM), and monitor DNS queries for the domain and its nameservers. Continuous re‑scanning on VirusTotal and other sandbox services is recommended, as detection signatures may emerge as the payload matures. Because the domain is only two days old, its operational window may be short, but adversaries frequently rotate domains; therefore, ongoing passive DNS monitoring and periodic review of blocklists are essential to detect any redeployment of the same hosting infrastructure under new labels.