saviiope[.]cfd

PhishDestroy identifies saviiope.cfd as an active credential-phishing domain under investigation for harvesting user login details. The page masquerades as a legitimate service to trick victims into submitting credentials, which are then exfiltrated to attacker-controlled servers. This domain was flagged on April 22, 2026, and is resolvable via IPv4 address 77.239.100.89. This domain was registered through Fewmoretaps OU d/b/a Trustname.com and currently remains undetected on VirusTotal with 0 detections out of 95 scanners; it also holds a valid Let's Encrypt SSL certificate. At the time of analysis, it is not listed on any major public blocklists and carries no known trust or reputation scores, indicating a very recent and unvetted presence. The rapid registration-to-activation cycle and lack of historical data suggest this campaign is likely opportunistic and automated. Users should immediately block saviiope.cfd at the network and endpoint levels using DNS sinkholing or host-file entries. Avoid all login prompts or data-entry forms hosted on this domain. Report the domain to your threat-intel team and to blocklist maintainers such as PhishTank or OpenPhish. If credentials were entered, rotate passwords immediately and enable multi-factor authentication on all related accounts. Monitor for follow-on spear-phishing or credential-stuffing attempts leveraging harvested data.