cvaszoec[.]cfd

Analysis of the domain cvaszoec.cfd confirms its classification as a credential phishing site, operational from October 22, 2025, until its takedown. The domain, registered through Aceville Pte. Ltd., resolved to the IP address 43.160.194.46, hosted on AS132203 in Singapore under Tencent Building infrastructure. Nameservers were set to a.dnspod.com, b.dnspod.com, and c.dnspod.com, a configuration commonly associated with malicious or abused hosting environments. No SSL certificate was detected, increasing the likelihood of interception or man-in-the-middle risks for visitors. The page title, 'Página de inicio - Logística global y envíos internacionales España,' indicates a focus on logistics and international shipping services in Spain, suggesting an attempt to deceive users associated with shipping, freight, or supply chain operations.

Google Safe Browsing explicitly flagged the domain for social engineering, aligning with the credential phishing classification. Scamadviser assigned a trust score of 20/100, while Gridinsoft rated it 0/100, further corroborating its malicious nature. AlienVault OTX recorded the domain in two threat intelligence pulses, and it appeared on one security blocklist. VirusTotal detections from 15 of 95 security vendors provide additional confirmation of its phishing activity.

Defenders should treat this domain as a confirmed threat. The absence of SSL, low trust scores, and explicit flags from Google Safe Browsing and security vendors justify immediate blocking at the DNS or proxy level. The domain’s infrastructure, including its hosting provider and nameservers, may warrant monitoring for additional malicious activity. Given its takedown status, no further active threat is present, but historical logs should be reviewed for connections to this domain.