morvessalintrava[.]com

PhishDestroy identifies morvessalintrava.com as an active credential theft phishing domain targeting users with a high-risk lure designed to harvest login credentials and sensitive personal information. This domain is currently engaged in malicious activity and has been designated as an elevated threat to unwary visitors. This domain was flagged by 1 of 95 VirusTotal security vendors, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP address 188.114.96.3. The domain morvessalintrava.com was created on May 11, 2026, and utilizes a Let's Encrypt SSL certificate to enhance its deceptive appearance. Despite its recent registration, the lack of widespread detection underscores its potential to evade initial scrutiny. Given the active status and low detection rate on VirusTotal, organizations and individuals are strongly advised to block access to morvessalintrava.com at the network perimeter and avoid interaction with any linked content. Users who may have entered credentials or personal information on this domain should immediately reset passwords on all related accounts and enable multi-factor authentication where available. Network defenders should monitor for connections to the associated IP address and investigate any internal systems that may have communicated with this malicious domain. Proactive threat hunting and DNS sinkholing are recommended to mitigate potential credential harvesting campaigns leveraging this infrastructure.