go[.]cevi[.]tools

The domain go.cevi.tools, which presented itself as a URL shortener under the title 'Cevi-URL-Shortener', has been identified as a credential theft operation. This threat type specifically targets users by tricking them into entering login credentials on fraudulent pages. The domain is currently offline, but its previous activity posed a significant risk to unsuspecting visitors.

Investigation reveals that go.cevi.tools was flagged by 5 of 95 VirusTotal security vendors, with the domain appearing on one security blocklist. It was registered through Key-Systems, LLC and created on April 28, 2026, resolving to the IP address 45.131.252.114. The SSL certificate was issued by Let's Encrypt (R12), which is commonly used by both legitimate and malicious sites. Despite the low blocklist count, the elevated risk level is justified by the nature of credential theft and the domain's recent creation.

Given that the domain is now offline, the immediate threat is neutralized. However, users should remain vigilant: never click on shortened URLs from unknown sources, and always verify the legitimacy of login pages before entering credentials. If you previously interacted with go.cevi.tools, change your passwords immediately and enable two-factor authentication on affected accounts.