Browser Connection to .cfd TLD

Ethan Andrews@eandrews

•updated Jun 2, 2026•12•0•29

Detects network connections to the '.cfd' TLD originating from common web browsers. This cheap TLD is increasingly abused by attackers to host phishing redirect pages delivered via malicious SVG files.