lvvas[.]org

The domain lvvas.org was registered on February 25, 2026 through Gname.com Pte. Ltd. and remains active as of the report date, July 12, 2026. The site presents a page titled “lvvas” and returns HTTP 200 responses, indicating that it is serving content to visitors. Its SSL certificate is issued by Let’s Encrypt (identifier YE1), confirming the use of TLS for encrypted communications.

Infrastructure analysis shows that lvvas.org resolves to the IP address 104.21.75.111, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain is delegated to the Cloudflare nameservers lady.ns.cloudflare.com and zod.ns.cloudflare.com. A Gridinsoft trust score of 0 out of 100 further underscores the malicious nature of the host. VirusTotal records a single detection out of 95 security vendors, and the domain appears on three independent security blocklists. It is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the classification as a phishing vector.

Threat intelligence sources corroborate the phishing assessment. AlienVault OTX references the domain in one pulse, linking it to generic phishing activity. The limited number of VirusTotal detections suggests that many security products have not yet flagged the site, which may reflect a recent deployment or evasion attempts. No additional payload or credential‑harvesting details are publicly disclosed, leaving the exact phishing lure and target audience uncertain.

Defenders should prioritize immediate containment of lvvas.org. Recommended actions include adding the domain and its resolving IP to network deny lists, enforcing TLS inspection to capture any credential traffic, and monitoring for related DNS queries to the listed Cloudflare nameservers. Continuous re‑evaluation of VirusTotal and blocklist updates is advised, as additional detections may surface as the campaign matures.