cvdf3dsfd[.]shop
“cvdf3dsfd.shop”
Evidence Summary
This domain, cvdf3dsfd.shop, is currently flagged as an active credential-theft phishing site. Infrastructure analysis reveals it resolves to the IP address 47.242.217.10 and uses nameservers launch1.spaceship.net and launch2.spaceship.net, which are associated with low-reputation hosting environments frequently exploited for phishing operations. The domain appears on one security blocklist and is blocked by PhishDestroy, indicating prior detection by automated anti-fraud systems.
VirusTotal reports a single detection from 91 security vendors, suggesting limited but confirmed malicious classification. No brand target or specific phishing kit has been identified in the available data, and the exact content of the site remains unanalyzed. However, the combination of low-detection hosting infrastructure, active blocklisting, and confirmed phishing classification strongly indicates a deliberate attempt to harvest user credentials.
Defenders should treat this domain as high-risk and implement immediate blocking at the DNS or network level. Registrar or hosting provider abuse reports may aid in takedown efforts, though the site remains operational as of July 28, 2026. Further investigation into the IP and nameserver history may reveal additional linked malicious domains.
Data Coverage
Network Security Intelligence
Threat Response Pipeline
Blocklist coverage
10 monitored external feeds · stored snapshot Aug 11, 2026
10 monitored external feeds No match
Detection timeline
-
First recorded
First stored value: Reachable
VirusTotal Analysis
Were You Affected by This Site?
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
Check Any Domain
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowReport Phishing
Submit suspicious domains to our threat database — protect the community
ReportLive Threat Feed
Recent phishing reports and observed availability changes
MonitorStay Informed, Stay Safe
Monitor live threats or contest this listing if you believe it's a false positive