csfmegs[.]cfd

The domain csfmegs.cfd was observed hosting a page titled “ASFINAG toll shop | official ASFINAG toll shop”. VirusTotal records indicate that sixteen of ninety‑three scanned security vendors flagged the domain, reflecting a moderate detection rate. The domain resolves to the IP address 104.21.91.172, which is owned by Cloudflare, Inc. (ASN 13335) and geolocated to the United States. Gridinsoft assigned a trust score of zero out of one hundred, suggesting a lack of reputation.

AlienVault OTX lists the domain in a single threat‑intel pulse, providing additional confirmation of malicious use. The SSL certificate presented on the site is identified as “WE1”, and no further certificate details are available. The domain was registered through Dynadot LLC on 24 December 2025 and has since been taken offline. It appears on one security blocklist and is actively blocked by the PhishDestroy mitigation service.

The combination of vendor detections, low trust score, OTX pulse, and blocklist inclusion demonstrates that the infrastructure is being leveraged for a generic phishing campaign targeting users of the Austrian toll operator ASFINAG. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole lists, and monitor for any re‑registration attempts. Incident response teams encountering traffic to this domain should treat associated connections as malicious, capture network artifacts, and correlate with any credential‑theft indicators. Ongoing observation of the hosting IP and related Cloudflare‑associated domains is recommended to detect potential lateral shifts in the phishing infrastructure.