cxvdf345f[.]shop

Analysis of the domain cxvdf345f.shop as of July 28, 2026 confirms that it is an active phishing infrastructure. The authoritative name servers listed for the zone are launch1.spaceship.net and launch2.spaceship.net, and DNS resolution consistently returns the IPv4 address 47.242.217.10. The domain is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, indicating that at least one reputable anti‑phishing service has identified it as malicious.

VirusTotal reports that one out of ninety‑one scanned scanners flagged the domain, providing independent confirmation of its illicit nature despite the low detection ratio. No additional public intelligence such as page titles, SSL certificates, HTTP response codes, or brand‑specific lures has been published, so the exact content and victim‑targeting strategy remain unknown. Nevertheless, the convergence of DNS evidence, blocklist inclusion, and the VirusTotal detection is sufficient to classify the domain as a high‑risk phishing site.

Defenders should immediately block cxvdf345f.shop at perimeter filters, update DNS sinkhole configurations to redirect queries to a safe response, and consider adding the associated IP address 47.242.217.10 to network‑wide deny lists. Continuous monitoring of the name servers and periodic rescans with VirusTotal or similar services are recommended to capture any changes in the payload or additional vendor detections. Organizations that rely on email or web gateway controls should ensure that their URL filtering rules reference the current blocklist entries to prevent end‑user exposure.