secure-vrf[.]cfd

This domain, secure-vrf.cfd, is a credential phishing site that has been taken offline as of July 23, 2026. The domain was created on February 21, 2026, and has been flagged by 13 of 93 security vendors on VirusTotal, indicating a moderate level of detection. The domain has also been identified in one threat intelligence pulse on AlienVault OTX and is present on one security blocklist, further emphasizing the risk it posed while active. The SSL certificate used was WE1, which is not a standard or trusted certificate, and the domain had a Gridinsoft trust score of 0/100, reflecting a complete lack of trust.

The domain resolved to the IP address 2606:4700:3033::ac43:bff6, which is located in the United States and is associated with AS13335 Cloudflare, Inc. This suggests that the site may have been using Cloudflare for DDoS protection or other services. PhishDestroy has blocked this domain, which is a positive step in mitigating its potential impact. The page title 'Security Verification' hints at the nature of the phishing attempt, likely designed to trick users into providing sensitive information under the guise of a security check.

While the domain is currently offline, defenders should remain vigilant and ensure that any systems or users previously exposed to this domain are evaluated for potential compromise. Additionally, monitoring for any resurgence or related domains is recommended. The exact content and target of the phishing attempt have not been fully analyzed, but the available evidence strongly suggests that it was a credential phishing operation aimed at stealing user credentials.