cxpee[.]cfd

Analysis of cxpee.cfd, created on 29 May 2026 and currently taken offline, shows multiple indicators of malicious phishing infrastructure. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to 188.114.97.3, an address owned by Cloudflare (AS13335) in the United States. Cloudflare’s DNS is reflected in the authoritative nameservers javon.ns.cloudflare.com and zainab.ns.cloudflare.com. The site served an HTTPS certificate from Let’s Encrypt (identifier YE2) and advertised HTTP/3 support, HSTS, and Cloudflare Browser Insights, suggesting a modern Node.js/Express stack. The page title returned by the server is “Abyss”, but no further content has been captured because the host is offline.

Reputation data reinforce the malicious assessment. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist. VirusTotal records three positive detections out of ninety‑one scanners, indicating that at least a subset of anti‑malware engines have identified the domain as hostile. PhishDestroy has also listed the domain as blocked, confirming its classification as a phishing vector. Uncertainty remains regarding the exact phishing campaign payload because the site is not reachable and no payload samples have been published.

Consequently, defenders cannot confirm the targeted brand or the specific credential‑harvesting technique employed. However, the combination of a fresh registration, low trust score, presence on blocklists, positive VirusTotal detections, and the use of a generic “Abyss” title is consistent with automated phishing kit deployments. Mitigation recommendations include adding 188.114.97.3 to network deny lists, blocking the domain at DNS resolvers, and monitoring Cloudflare‑hosted IP ranges for similar patterns. Organizations should also update web‑gateway and endpoint protection signatures to incorporate the three VirusTotal detections and the Gridinsoft rating.