lvvas[.]tw

The domain lvvas.tw was registered on May 03 2026 through GNAME.COM and is currently served from the Cloudflare network (AS13335). DNS resolution points to 104.21.39.19, and the authoritative nameservers are lady.ns.cloudflare.com and zod.ns.cloudflare.com. The site presents a valid TLS certificate issued by Let’s Encrypt (certificate identifier E8), returning HTTP 200 for the root URL and advertising the page title “lvvas”.

Threat intelligence sources label the site as a generic phishing operation. VirusTotal records a single positive detection out of 95 scanned engines. AlienVault OTX includes the domain in two distinct threat pulses. Independent blocklists such as PhishDestroy, MetaMask and SEAL have listed the domain, and three public blocklists also contain it. The Gridinsoft trust score is 0 / 100, indicating a high likelihood of malicious intent.

The available artefacts confirm that the infrastructure is fully cloud‑hosted, leveraging Cloudflare’s CDN and SSL termination. No additional hosting details or back‑end server fingerprints have been disclosed, leaving the exact phishing content and target brand unspecified. The page title “lvvas” provides no indication of a compromised service, and the lack of publicly visible malicious payloads means the precise lure (e.g., credential‑stealing form) cannot be verified from the current data set.

Given the high‑confidence classification and the active status of the domain, defenders should incorporate lvvas.tw into URL filtering policies and block the associated IP address 104.21.39.19 at the network perimeter. Continuous monitoring of the domain’s DNS records and TLS certificate renewal is advised to detect any re‑hosting attempts. Organizations should also share observed indicators with upstream threat‑sharing platforms to enrich collective awareness.