lotivo[.]app

PhishDestroy identifies lotivo.app as an active investment scam domain posing as a legitimate financial platform, flagged by 11 out of 95 security vendors on VirusTotal. This domain, created on April 03, 2026, is registered through Fewmoretaps OU d/b/a Trustname.com and resolves to IP 193.142.59.10. Its SSL certificate is issued by Let's Encrypt, which may lend it an air of legitimacy while concealing malicious intent. The site appears to target users with deceptive financial offers, likely involving cryptocurrency or trading scams, leveraging urgency and fabricated credibility to extract funds or sensitive data. lotivo.app exhibits multiple red flags consistent with generic phishing campaigns. Security vendors have flagged it at a rate of 11/95, indicating elevated threat potential. The domain was registered through a privacy-focused registrar (Fewmoretaps OU d/b/a Trustname.com), which is frequently exploited by threat actors to obscure ownership. It resolves to IP 193.142.59.10, a hosting infrastructure linked to malicious activity. The domain’s recent creation date (April 03, 2026) suggests it is part of a rapidly deployed campaign. While Google Safe Browsing (GSB) status and blocklist counts are not specified in available data, the combination of low VT detection rates and fresh registration strongly indicates a newly active threat. The use of a Let's Encrypt certificate further complicates detection by appearing legitimate at first glance. As of current analysis, lotivo.app remains active and accessible. Immediate action is advised: users should avoid interacting with the site, refrain from entering personal or financial data, and report the domain to relevant cybersecurity authorities (e.g., Google Safe Browsing, PhishDestroy). Organizations should block the domain and IP (193.142.59.10) at the network perimeter. While the domain’s recent creation limits historical exposure, the elevated VT detection rate and lack of reputation suggest it may quickly escalate in malicious activity. Remaining risk is moderate to high due to its active status, low initial detection rates, and potential to harvest credentials or funds under the guise of financial services. Proactive blocking and user awareness are critical to mitigate further compromise.