drevolaiav93[.]it

Analysis of drevolaiav93.it indicates a high-risk phishing domain targeting users of the Drevola AI platform. The domain was registered on February 24, 2026, through Dynadot LLC and is currently offline, returning an HTTP 403 status. Infrastructure analysis reveals Cloudflare hosting (AS13335) with nameservers nora.ns.cloudflare.com and mustafa.ns.cloudflare.com, resolving to IP 104.21.1.171 in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for both legitimate and malicious sites.

The page title, '✅ Drevola IA v9.3™ | Sito Ufficiale | Accesso Verificato 2026 🛡️,' explicitly references Drevola AI, suggesting an attempt to impersonate the official platform. Google Safe Browsing flags the domain for social engineering, and it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. Seven of 93 security vendors on VirusTotal detect the domain as malicious.

No specific phishing kit or payload has been confirmed in available data, and the exact content of the site remains unanalyzed. Defenders should treat this domain as part of a credential-harvesting campaign targeting Drevola AI users. Block access to the domain and IP, monitor for related infrastructure (e.g., Cloudflare-hosted domains with similar naming patterns), and alert users to verify official channels before entering credentials. The domain's recent registration and rapid detection by multiple vendors suggest an active but short-lived operation.