bivetysavings[.]com

This domain, bivetysavings.com, is flagged as a high-risk phishing site specifically impersonating BivetySavings Bank. The page title, 'BivetySavings Bank,' directly mimics the branding of a legitimate financial institution, suggesting the campaign targets customers of this entity. No explicit drainer kit signatures have been identified in initial scans, though the infrastructure aligns with credential-harvesting operations commonly used in financial phishing schemes. Analysis indicates the domain was registered on September 10, 2024, through TuringSign Inc. d/b/a Cosmotown, a registrar frequently associated with malicious domain registrations. The domain resolves to the IP address 198.251.84.200, which has been linked to prior phishing activity. Detection metrics reveal that 5 out of 95 security vendors on VirusTotal have flagged the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Let’s Encrypt, a common tactic to lend superficial legitimacy to phishing sites. AlienVault OTX records show the domain in three threat intelligence pulses, further corroborating its malicious classification. As of the latest assessment, bivetysavings.com remains active and unresolved by the registrar or hosting provider. The domain continues to resolve to the same IP address, and no takedown actions have been observed. The persistent availability of the site poses a significant risk to users who may be deceived into entering sensitive credentials. Organizations and individuals are advised to block the domain and IP at the network level, implement browser-based warnings for users, and monitor for related phishing campaigns targeting the same brand. Enhanced user education on recognizing phishing indicators, such as suspicious domain names and SSL certificate issuers, is recommended to mitigate exposure.