cvf5dsdf[.]shop

Analysis shows that the domain cvf5dsdf.shop is currently active and resolves to the IP address 47.242.217.10. The domain is delegated to the nameservers launch1.spaceship.net and launch2.spaceship.net, indicating use of a shared DNS service that may host additional malicious sites. It appears on a single security blocklist and has been explicitly blocked by the PhishDestroy filtering service, confirming that external threat intelligence sources consider it malicious.

VirusTotal reports that one out of ninety‑five scanned security vendors flagged the domain, providing independent confirmation of suspicious activity. No public information on SSL certificates, HTTP response codes, or page titles is available, so the exact content and visual impersonation techniques remain unknown. Defenders should immediately add cvf5dsdf.shop to firewall deny lists and DNS block policies, and consider extending blocks to the hosting IP 47.242.217.10 to mitigate potential pivot activity.

Ongoing monitoring of the launch1.spaceship.net and launch2.spaceship.net name servers is advised, as they may be leveraged for future phishing domains. Continuous ingestion of blocklist updates and VirusTotal scans is recommended to capture any change in detection rates, and security teams should alert users about the presence of this generic phishing infrastructure to reduce credential‑ harvesting risk.