cvaszoea[.]cfd

Analysis of cvaszoea.cfd indicates a high‑risk credential phishing infrastructure that has been taken offline as of the report date, July 23 2026. The domain was registered on October 22 2025 through Aceville Pte. Ltd. and points to the IP address 43.160.194.46, which resides in Singapore under ASN 132203 (Tencent Building, Kejizhongyi Avenue). No SSL certificate is presented, meaning the site operates over plain HTTP, a common trait for phishing deployments that avoid encryption overhead. The page title returned by the server—"Página de inicio - Logística global y envíos internacionales España"—suggests the attacker may be attempting to lure Spanish‑speaking users with a logistics‑related narrative, though the exact content has not been examined.

Security‑vendor coverage on VirusTotal shows 17 of 95 scanners flagging the domain, confirming malicious detection across multiple engines. Google Safe Browsing classifies the URL as social engineering, reinforcing the credential‑phishing assessment. Independent reputation services are extremely low: Scamadviser assigns a trust score of 1 / 100 and Gridinsoft a score of 0 / 100, both indicating near‑certain malicious intent. The domain appears on at least one public blocklist and has been specifically listed by PhishDestroy, demonstrating that anti‑phishing communities have already taken mitigation steps.

AlienVault OTX records the domain in a single threat‑intel pulse, providing an additional data point for correlation. Nameserver configuration uses three dnspod.com records (a.dnspod.com, b.dnspod.com, c.dnspod.com), a pattern frequently observed in disposable or rapidly re‑hosted phishing sites. Defenders encountering traffic to cvaszoea.cfd should block the domain and its resolved IP at perimeter and DNS filtering layers, monitor for any residual credential submissions, and consider enriching incident logs with the observed trust scores and vendor detections.