sdfofsdaosdfaofsd[.]cfd

The domain sdfofsdaosdfaofsd.cfd was registered on February 21, 2026 through Global Domain Group LLC and is currently listed as taken offline. The authoritative nameservers ashley.ns.cloudflare.com and marvin.ns.cloudflare.com resolve the domain to the IP address 172.67.222.56, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. An HTTPS certificate issued by Google Trust Services under the WE1 designation is present, indicating a valid TLS handshake despite the domain’s malicious classification.

When accessed, the HTTP response returned a 404 status code and the page title was reported as "Document," suggesting that the expected phishing payload is not being served at the time of analysis. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service, reinforcing the view that it has been used for phishing purposes. VirusTotal scans show that three of ninety‑three security vendors flagged the domain, providing additional corroboration of malicious intent.

The limited public footprint—absence of additional blocklist listings, a single detection count, and the offline status—leaves uncertainty regarding the current operational state of the phishing campaign and the specific target audience or content that was originally delivered. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated Cloudflare IP range, and consider adding the domain to internal threat‑intel feeds. Ongoing observation of any re‑activation attempts, changes in HTTP response codes, or new vendor detections is recommended to assess whether the threat actor resumes activity.