cvdf3dsfd[.]shop

This domain, cvdf3dsfd.shop, is currently flagged as an active credential-theft phishing site. Infrastructure analysis reveals it resolves to the IP address 47.242.217.10 and uses nameservers launch1.spaceship.net and launch2.spaceship.net, which are associated with low-reputation hosting environments frequently exploited for phishing operations. The domain appears on one security blocklist and is blocked by PhishDestroy, indicating prior detection by automated anti-fraud systems.

VirusTotal reports a single detection from 91 security vendors, suggesting limited but confirmed malicious classification. No brand target or specific phishing kit has been identified in the available data, and the exact content of the site remains unanalyzed. However, the combination of low-detection hosting infrastructure, active blocklisting, and confirmed phishing classification strongly indicates a deliberate attempt to harvest user credentials.

Defenders should treat this domain as high-risk and implement immediate blocking at the DNS or network level. Registrar or hosting provider abuse reports may aid in takedown efforts, though the site remains operational as of July 28, 2026. Further investigation into the IP and nameserver history may reveal additional linked malicious domains.