mva[.]news

The domain mva.news was registered on February 21, 2026 and is currently offline. Public scans show that the site resolves to the IP address 172.67.148.20, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented by the server is issued by GTS CA 1P5, indicating the use of a public certificate authority.

The page title retrieved during the brief live period was "Heroes of Mavia | Build Your Base & Battle for RUBY," suggesting an attempt to lure victims with gaming‑related terminology, while the listed scam type identifies the operation as brand impersonation. The domain appears on two security blocklists and is explicitly blocked by PhishDestroy and Enkrypt, confirming that multiple threat intelligence feeds have flagged it as malicious. VirusTotal submitted the site to 95 scanning engines and returned no detections; the lack of detections is not evidence of benign intent and should be interpreted as a false negative risk.

The combination of recent registration, use of a shared Cloudflare front‑end, a public TLS certificate, and inclusion on blocklists aligns with typical patterns observed in credential‑harvesting campaigns that exploit brand trust. Defenders should continue to block the domain at perimeter controls, monitor DNS queries for the associated IP, and consider adding the host to internal blocklists. Given the offline status, ongoing intelligence collection is advised to capture any re‑hosting attempts or related infrastructure that may emerge under different subdomains or IP ranges.