korvesta[.]icu

Analysis of the domain korvesta.icu shows that it was registered on March 11, 2026 through Aceville Pte. Ltd. and is served by the authoritative nameservers ns1.teodns.com and ns2.teodns.com. The site presented a single page whose title resolved to "Access Restricted," and the SSL certificate in use was issued by TrustAsia Technologies, Inc., indicating a standard commercial certificate rather than a self‑signed or free‑tier certificate. The domain resolves to the IPv4 address 43.169.13.15, which maps to a hosting location in Singapore (ACE). Current network checks list the domain as offline, and it has been taken down from public access.

Threat detection services have flagged the domain: three of ninety‑four VirusTotal security vendors recorded detections, and the domain appears on one external blocklist. Additionally, PhishDestroy has added korvesta.icu to its blocklist, confirming that known anti‑phishing infrastructure is already aware of the indicator. The reported scam type is an Account Takeover operation, though no specific victim brand or service was disclosed in the captured metadata.

Because the only visible artifact is the "Access Restricted" page title, the exact luring vector or credential‑harvesting page layout remains unverified. Defenders should proactively block the domain and its associated IP address at perimeter firewalls and DNS filtering layers, monitor for any resurgence of the host or similar subdomains under the same nameservers, and continue to reference threat‑intel feeds that include the three vendor detections and the PhishDestroy blocklist entry. Ongoing observation of the registrar Aceville Pte. Ltd. for new registrations using the same infrastructure is recommended to catch potential campaign extensions.