bdjwv[.]cfd

On July 23, 2026, bdjwv.cfd was observed as an offline generic phishing infrastructure. The domain was registered on February 21, 2026 and resolves to the IPv4 address 195.66.101.154, which is announced by AS41439 (MAXCOM sh.p.k.) and geolocated to Algeria. The host presents an SSL certificate issued to the subject “1.com”, indicating the use of a generic or reused certificate not matching the domain name.

HTTP requests to the domain return a 404 Not Found page title, suggesting the malicious payload has been removed or the site is deliberately returning an error page after takedown. VirusTotal reports that 7 out of 93 scanning engines flagged the domain, confirming that at least a subset of security vendors consider it malicious. The domain appears on one public blocklist and is actively blocked by the PhishDestroy service, providing additional evidence of its classification as phishing.

The current offline status prevents active probing, but the infrastructure artifacts – registration date, hosting ASN, SSL mismatch, and vendor detections – remain useful for attribution and future mitigation. Defenders should continue to block the domain and associated IP address at perimeter devices, update threat intelligence feeds with the observed indicators, and monitor for re‑use of the underlying hosting provider or certificate in new campaigns. Because the site content has not been captured, the specific brand or credential‑stealing technique employed by the original campaign remains unknown, and further analysis would be required if the domain reappears.