01vhl[.]mjt[.]lu

This domain, 01vhl.mjt.lu, is identified as a generic phishing infrastructure targeting user credentials through deceptive login interfaces. Analysis indicates no direct association with a specific brand or drainer kit, though the subdomain structure and page title ('Technical subdomain') suggest an operational framework designed to evade detection while harvesting sensitive information. The lack of a recognizable brand affiliation increases the likelihood of broad, opportunistic targeting rather than a focused campaign against a single entity. Infrastructure analysis reveals the domain is registered through OVH and resolves to the IP address 35.241.186.140. It holds a VirusTotal detection score of 2/95 security vendors, indicating limited but confirmed malicious classification. The domain appears on three security blocklists—PhishDestroy, PhishingDB, and OISD—further validating its phishing designation. The SSL certificate is issued by DigiCert Inc, a detail that may lend a superficial appearance of legitimacy while failing to mitigate the underlying threat. No creation date is available in the provided data, but the domain's presence on multiple blocklists suggests it has been active long enough to attract scrutiny. The domain is currently offline, reducing immediate risk of user exposure. However, the infrastructure remains a latent threat, as phishing domains frequently resurface under altered subdomains or IP addresses. The elevated risk level stems from the domain's prior use in credential harvesting and its inclusion on multiple security blocklists. Users and organizations are advised to monitor for related indicators of compromise, including the IP address 35.241.186.140 and any subdomains under mjt.lu. Network-level blocking of the domain and associated IP is recommended to prevent potential reactivation or lateral movement within phishing campaigns.