reaunt-sevice-id[.]top

This domain is flagged as an elevated-risk credential harvesting phishing site targeting users through deceptive maintenance pages. Analysis indicates the domain was designed to mimic legitimate service outages, tricking victims into entering login credentials under the guise of temporary unavailability. The threat type aligns with common phishing tactics leveraging urgency and false technical disruptions to bypass user skepticism. Infrastructure analysis reveals the domain reaunt-sevice-id.top was registered on June 01, 2026, through Openprovider. It is currently offline but was previously detected by 17 out of 95 security vendors on VirusTotal, indicating broad recognition as malicious. The domain appears on one security blocklist and was actively blocked by enterprise-grade filtering systems. No associated IP addresses or hosting providers were disclosed in available telemetry, but the creation date suggests recent deployment for short-term phishing campaigns. Mitigation requires immediate domain blacklisting in network security controls, including DNS filtering and email gateway rules. Security teams should prioritize user education on recognizing fake maintenance pages, particularly those lacking official branding or using generic templates. If credentials were entered, affected accounts must be locked, passwords reset, and multi-factor authentication enforced. Monitoring for follow-up attacks, such as targeted phishing emails referencing the same fake outage, is recommended.