vosvixo[.]cfd

This domain, vosvixo.cfd, is actively engaged in credential theft through brand impersonation of Messenger, a widely used communication platform. Analysis indicates the site mimics legitimate login interfaces to harvest user credentials, a common tactic in targeted phishing campaigns. No direct evidence of a crypto drainer kit or payment redirection was observed, but the focus on credential capture aligns with broader account takeover objectives. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.96.3 and was registered on June 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. Security vendors on VirusTotal flag the domain at 15/95, indicating moderate consensus on its malicious nature. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy while the domain remains unlisted on Google Safe Browsing. A single threat intelligence pulse in AlienVault OTX further corroborates its association with phishing activity. The domain remains active and poses an elevated risk to users unfamiliar with Messenger’s authentic infrastructure. Immediate response actions include blocking resolution at the DNS level and flagging the IP for network-level filtering. Despite these measures, residual risk persists due to the domain’s recent registration and the use of a trusted SSL provider, which may deceive users into trusting the site. Organizations are advised to update endpoint protection rules to include this domain and its associated IP, while users should verify the authenticity of Messenger login pages through official channels before entering credentials.