desenvendad[.]cfd

This domain, desenvendad.cfd, was registered on June 25, 2026 through TuringSign Inc. d/b/a Cosmotown and uses the authoritative name servers ndns1.cosmotown.com and ndns2.cosmotown.com. DNS resolution points to the IPv4 address 66.85.46.240, which is the sole host observed for the domain. The domain appears on two public phishing blocklists, PhishDestroy and OpenPhish, and Google Safe Browsing classifies it as a social‑engineering threat.

On VirusTotal the domain received detections from seven of ninety‑five scanning engines, confirming that multiple security vendors have identified malicious activity associated with it. The risk rating is high and the infrastructure remains active as of the report date, July 22, 2026. Analysis indicates that the domain is being used for a generic phishing campaign, but no additional artefacts such as page titles, SSL certificates, or HTTP response codes have been disclosed, leaving the exact payload and target brand undefined.

The limited visibility into the web content means defenders cannot rely on signature‑based blocking of specific page elements, and must instead focus on network‑level indicators. Recommended mitigation steps include adding 66.85.46.240 to deny‑list rules on perimeter firewalls and DNS filtering solutions, ensuring that the domain and its name‑server entries are blocked in corporate DNS resolvers, and monitoring for any outbound connections to the associated IP address. Security teams should also flag any email that references desenvendad.cfd for further investigation, and continue to watch for updates from the blocklist providers and VirusTotal for new detection signatures.