securevisage[.]com

The domain securevisage.com was registered through Name SRS AB and first seen on 9 June 2025. Infrastructure analysis shows it resolves to the Amazon Web Services address 13.202.56.65, which is announced by AS16509 (Amazon.com, Inc.) and geolocated to India. The site presents a valid TLS certificate issued by Let’s Encrypt (R12) and returns HTTP 200 for the root URL, indicating an operational web service. The page title observed is “SecureVisage | Enterprise-Grade Face Recognition & Identity Verification”, suggesting the attacker is impersonating a facial‑recognition solution. The hosting stack includes Node.js, React, Next.js, Webpack and the presence of Google Maps and Razorpay scripts, which are commonly leveraged to add credibility to fraudulent pages.

Reputation signals are strongly negative: the domain appears on one security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100. On VirusTotal, 1 of 95 scanning engines flagged the domain, reinforcing the suspicion of malicious intent. MX records point to mx1.hostinger.com (priority 5) and mx2.hostinger.com (priority 10), indicating use of a third‑party mail service for credential harvest. Nameservers are ns1.dns-parking.com and ns2.dns-parking.com, typical of parked or transient domains.

The available evidence classifies the site as a credential‑phishing operation targeting credentials for the purported SecureVisage service. No further behavioral data, such as phishing page screenshots or payload analysis, is currently available, so the full scope of victim impact remains uncertain. Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the IP 13.202.56.65, and add the associated MX hosts to email‑filtering rules. Email security gateways should be tuned to flag messages claiming to originate from securevisage.com, and users should be educated to verify TLS certificates and URLs before entering credentials.