kuvvugu[.]cfd

The domain kuvvugu.cfd is classified as a generic phishing threat, currently active and impersonating the Messenger brand. The page title displayed is 'Messenger', indicating an attempt to harvest login credentials or personal data. The domain has an elevated risk level based on multiple technical indicators.

Infrastructure analysis reveals that kuvvugu.cfd resolves to IP address 172.67.150.196 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The SSL certificate is issued by Google Trust Services. VirusTotal reports 16 of 95 security vendors flagging this domain as malicious. The domain was created on June 27, 2026, which is anomalously dated in the future, suggesting possible manipulation of registration records or a placeholder entry. No specific blocklist counts or trust scores are available from the provided data, but 16 detections indicate a moderate consensus among security vendors.

The domain is currently active and serving a phishing page. Users should avoid interacting with this domain or providing any credentials. Recommendations include blocking the domain at network perimeter, adding it to threat intelligence feeds, and monitoring for related subdomains or IPs. Organizations should alert users to the risk of fake Messenger login pages and enforce multi-factor authentication to mitigate credential theft. Since the threat is active and impersonates a well-known brand, immediate action is warranted to prevent compromise.