mail-sd27j[.]dvhtechnology[.]com

PhishDestroy identifies mail-sd27j.dvhtechnology.com as an active generic phishing host registered on 2025-11-26 to deliver fraudulent credentials-stealing lures. The domain resolves to IP 188.114.97.3 and currently presents an SSL certificate issued by Let’s Encrypt, indicating active HTTPS infrastructure designed to mimic legitimate mail services. No specific brand or drainer kit fingerprint is yet confirmed, but the low detection rate and rapid creation window suggest opportunistic deployment against a broad user base. This domain was flagged with a VirusTotal score of 13/95 detections and is currently unlisted on Google Safe Browsing. It was registered via NameSilo, LLC and came online on 2025-11-26, indicating a very recent and possibly automated setup. With a single IP address hosting the content and no current blocklist presence, the infrastructure remains lightweight and highly movable, increasing operational agility for threat actors. The threat is classified as active and under investigation with a current risk level of under_investigation. PhishDestroy advises immediate network and endpoint blocking of both the domain and its hosting IP (188.114.97.3) to prevent credential theft campaigns. Users should avoid clicking any links or entering data on this domain. Remaining risk centers on potential rapid re-registration or IP rotation, necessitating continuous monitoring and timely takedown coordination with hosting providers and registrars.