ankit17[.]serv00[.]net

This domain, ankit17.serv00.net, is identified as a credential harvesting phishing site targeting users through deceptive login portals. Analysis confirms the domain remains active as of the latest verification, with no observed takedown or mitigation efforts. No specific brand impersonation is evident from the page title or surface-level content, though the infrastructure aligns with generic phishing campaigns designed to capture sensitive authentication details. Infrastructure analysis reveals the domain was registered on June 03, 2019, through OVH, SAS, and resolves to the IP address 128.204.218.48, hosted on AS57367 (Atman Sp. z o.o.) in Poland. The SSL certificate is issued by Let's Encrypt (identifier E8), a common choice for malicious actors due to its low-cost and automated issuance. Security vendor detections on VirusTotal report 12 of 95 engines flagging the domain as malicious, while it appears on two independent security blocklists. The page title, ankit17.serv00.net, offers no legitimate context, further supporting its classification as phishing infrastructure. Current status indicates the domain is still operational, posing an ongoing risk to users who may encounter it through phishing emails, compromised redirects, or malicious advertisements. Organizations are advised to block the domain and its resolving IP at the network perimeter. Endpoint protection systems should be updated to include this indicator of compromise (IOC). Users who may have interacted with the site should reset credentials on any accounts accessed during the exposure window and enable multi-factor authentication where available. Continuous monitoring of related subdomains under serv00.net is recommended, as this infrastructure may be reused for future campaigns.