ca[.]gov-zae[.]cfd

PhishDestroy identifies ca.gov-zae.cfd as an active crypto-draining phishing site masquerading as a legitimate California government portal. Evasion tactics include a superficially valid SSL certificate issued by Let’s Encrypt and registration through Dynadot LLC on March 25, 2026. The domain resolves to IP 43.165.68.78, yet it has already been blocked by OpenPhish and PhishingArmy, and it is flagged by 13 out of 95 VirusTotal security vendors, placing the site at an elevated risk level. This domain was flagged within hours of creation, highlighting the attacker’s preference for time-boxed campaigns. Registration via Dynadot LLC offers no inherent legitimacy, while the Let’s Encrypt certificate only secures data in transit without authenticating site ownership. The IP address 43.165.68.78 has no established reputation and appears exclusively in this malicious context. With zero trust score across blocklists and a 14% detection rate on VirusTotal, the site demonstrates clear malicious intent—specifically, credential harvesting followed by cryptocurrency fund extraction. Mitigation against this crypto drainer threat requires user-level controls and network enforcement. Users must refrain from entering any credentials or wallet addresses on ca.gov-zae.cfd. Organizations should block the domain and IP at DNS and firewall layers, referencing the exact indicators—domain, IP, and registrar. For ongoing protection, PhishDestroy recommends continuous monitoring of newly registered .cfd domains that mimic government TLDs.