exfacilis[.]cfd

Analysis of exfacilis.cfd shows the domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently marked as taken offline. The authoritative name servers, rachel.ns.cloudflare.com and simon.ns.cloudflare.com, resolve the domain to IP address 172.67.176.198, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site employed Cloudflare services, including HTTP/3, and presented a TLS certificate issued by Google Trust Services under the WE1 label, indicating a valid HTTPS configuration. The page title observed during the brief live window was the Russian phrase "Не упусти возможность!" ("Do not miss the opportunity!").

VirusTotal scans recorded two detections out of ninety‑three security vendors, confirming that at least a subset of scanners identified malicious behavior. Independent threat feeds have placed the domain on a single security blocklist, and PhishDestroy has also listed it as blocked. The Gridinsoft trust score of 0 out of 100 further reinforces the assessment of high risk.

While the exact phishing payload or targeted brand cannot be confirmed from the available data, the combination of a newly created domain, rapid deployment behind Cloudflare, a low trust score, and multiple vendor detections strongly suggests a malicious intent, likely aimed at credential harvesting or fraud. Defenders should continue to block the domain at network perimeters, update URL filtering policies to include exfacilis.cfd, and monitor for any resurgence of activity. Additional investigation, such as sandboxed retrieval of the landing page content, may reveal the specific lure or credential‑capture mechanism, but the current evidence already warrants elevated remediation measures.