epvaie[.]xyz

This domain, epvaie.xyz, was observed as a generic phishing site and is currently taken offline. The domain was registered on 21 February 2026 and resolves to the IPv4 address 45.128.184.199, which is allocated to AS202423 belonging to Tyurin Viktor Mihaylovich in Russia. The hosting infrastructure has been flagged by the PhishDestroy blocklist, and the domain appears on one additional security blocklist. VirusTotal scans show that two of ninety‑five security vendors flagged the domain, indicating some detection of malicious activity. The site presented an SSL certificate classified as R10, suggesting a low‑trust certificate that is often associated with abusive domains.

No public page title, brand targeting, or detailed content analysis has been released, so the exact phishing content remains unknown. The limited visibility of the site—no page title or brand information—means that attribution to a specific campaign cannot be confirmed. However, the presence on a reputable phishing blocklist and the dual vendor detections on VirusTotal provide actionable confidence that the domain was used for credential‑stealing attempts. The Russian‑based IP suggests that the operator may be leveraging hosting services that are frequently abused for malicious phishing infrastructure. Defenders should add epvaie.xyz to deny lists, block traffic to its resolved IP address, and monitor for any re‑registration or resurgence of the domain.

Continued scrutiny of the associated ASN and IP range is advised, as the same infrastructure may be reused for future campaigns. Because the domain is offline, active exploitation is unlikely at present, but the historical indicators warrant inclusion in threat‑intel feeds and correlation with any observed credential‑harvesting attempts. Defenders should also consider updating DNS filtering policies to drop queries for epvaie.xyz, and ensure that email security gateways incorporate the domain into their URL reputation checks.