verifyau[.]servicevision[.]io

This domain, verifyau.servicevision.io, is flagged as a credential phishing site designed to deceive Australian accounting firms by mimicking a legitimate AML/CTF compliance platform. The threat type is highly targeted, focusing on professionals required to verify client identities under anti-money laundering and counter-terrorism financing regulations. Analysis indicates the site likely employs social engineering tactics, such as fake login portals or document submission forms, to harvest credentials and sensitive financial data. No direct evidence of a drainer kit or cryptocurrency wallet interaction was identified in initial scans, but the infrastructure supports rapid credential exfiltration if compromised. Infrastructure analysis reveals the domain was registered on May 08, 2024, through Name.com, Inc., and resolves to the IP address 104.21.38.151, a Cloudflare-associated endpoint often used to obfuscate hosting origins. The domain appears on one security blocklist and is flagged by 6 out of 95 security vendors on VirusTotal, indicating moderate but growing detection. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy while failing to mitigate the underlying phishing threat. No Google Safe Browsing (GSB) hits were recorded at the time of assessment, suggesting the campaign may still be in an early or evasive phase. The domain has been taken down, reducing immediate exposure to end users. However, residual risk remains elevated due to the targeted nature of the phishing scheme and the potential for credential reuse across other platforms. Organizations are advised to monitor for unauthorized access attempts using credentials potentially harvested from this domain, particularly within accounting and financial compliance workflows. Users who interacted with the site should reset passwords immediately and enable multi-factor authentication on all related accounts. Proactive threat hunting for indicators such as the domain, IP, or SSL certificate fingerprint is recommended to identify any lingering compromise.