lunverox[.]sbs

lunverox.sbs was first observed on March 10, 2026, registered through Dynadot LLC. The domain is classified as a generic phishing site and assigned a high risk level. Its short lifespan of four months and a trust score of 0/100 indicate a purpose‑built malicious operation. The authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net resolve the domain to IP 91.84.122.139, which belongs to AS216071 SERVERS TECH FZCO located in the Netherlands. The web server runs Nginx with HTTP Strict Transport Security enabled and presents a Let’s Encrypt R13 certificate. An HTTP 302 redirect is observed, and the page title returned is “RU • MaxUnique 09 • 2026”, suggesting a possible lure aimed at Russian‑speaking users. VirusTotal scans report that 5 of 95 security vendors flag the domain as malicious, and Gridinsoft assigns a zero‑point trust rating. The site appears on two public blocklists and is actively blocked by PhishDestroy and ScamSniffer, reinforcing the phishing assessment. The limited detection footprint is consistent with a newly deployed campaign. While the infrastructure and detection signals confirm a phishing operation, the specific credential‑stealing kit, target brand, and victim interaction flow remain unknown. No additional payload hashes or command‑and‑control endpoints have been disclosed, leaving the full scope of the campaign uncertain. Defenders should immediately block lunverox.sbs at DNS and proxy layers, enforce TLS inspection to capture the redirect, and monitor outbound connections to 91.84.122.139. Continuous re‑evaluation of threat intelligence feeds is advised to detect any expansion of the associated infrastructure or emergence of new indicators.