cvg67g[.]shop

Analysis of cvg67g.shop indicates an active generic phishing infrastructure. The site returns HTTP 200 and presents the page title “首页”, which is a generic Chinese term for “home page”. No TLS certificate is deployed, meaning traffic is unencrypted and susceptible to interception. DNS resolution points to the single IPv4 address 47.242.217.10, which is geolocated to Hong Kong.

The address is hosted on infrastructure operated by Spaceship, Inc., as reflected by the registrar information and the authoritative name servers launch1.spaceship.net and launch2.spaceship.net. VirusTotal scans have recorded detections from four of ninety‑one security vendors, confirming that the domain is recognized as malicious by multiple independent engines. The domain appears on one public blocklist and is specifically listed by PhishDestroy, reinforcing its classification as a phishing resource. The combination of a lack‑of SSL, a generic home‑page title, and a modest detection count suggests a low‑profile deployment intended to evade automated scrutiny while remaining reachable to targeted victims.

Current uncertainties include the exact content served to users, the identity of the targeted brand or credential collection vector, and any additional command‑and‑control infrastructure that may be leveraged after initial compromise. Defenders should block the domain at network boundaries, enforce TLS inspection where possible, and monitor DNS queries for the associated IP address and its name servers. Incident response teams should treat any credentials or personal data submitted to this host as compromised and advise affected users to reset passwords and review account activity. Ongoing observation of the IP reputation and periodic rescanning on VirusTotal are recommended to capture any changes in detection coverage.