cvaszoev[.]cfd

Analysis of the domain cvaszoev.cfd indicates it was a brand impersonation scam targeting Facebook users. The domain was registered on October 22, 2025, through Aceville Pte. Ltd. and resolved to the IP address 43.160.194.46, hosted in Singapore under AS132203 (Tencent Building, Kejizhongyi Avenue). No SSL certificate was present, increasing the risk of unencrypted data transmission. The page title, 'Quality Women's Leather Shoes and Accessories | Maguire Shoes,' does not align with Facebook's branding, suggesting an attempt to deceive users into believing the site was a legitimate e-commerce platform rather than a social media login portal.

The domain appeared in five threat intelligence pulses on AlienVault OTX, and 15 of 95 security vendors on VirusTotal flagged it as malicious. It was also listed on one security blocklist and blocked by PhishDestroy. Trust scores from Gridinsoft (0/100) and Scamadviser (1/100) further indicate high-risk activity. The domain's nameservers (a.dnspod.com, b.dnspod.com, c.dnspod.com) are associated with a provider frequently used in malicious campaigns.

As of July 23, 2026, the domain is offline, reducing immediate risk to users. However, defenders should treat any past interactions with this domain as compromised. Organizations should update blocklists to include cvaszoev.cfd and monitor for related infrastructure, such as the IP 43.160.194.46 or domains registered through Aceville Pte. Ltd. with similar naming patterns. The exact phishing kit or payload used remains unconfirmed, but the combination of brand impersonation, low trust scores, and detection by multiple vendors confirms malicious intent.