svvapcowfl[.]eu[.]com

Analysis of the domain svvapcowfl.eu.com indicates it is being used for credential harvesting. The site resolves to the IP address 104.21.96.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain was registered on February 21, 2026 through Instra Corporation Pty Ltd. and is served by the four CentralNic name servers ns1.centralnic.net through ns4.centralnic.net. The MX record points to eu-com-wildcard-null-mx.centralnic.net with priority zero, suggesting no functional mail service.

The presented HTTPS certificate is identified as WE1, but the site is currently taken offline, a state confirmed by the latest status check. VirusTotal scans show that three of ninety‑three security vendors flagged the domain, and it appears on one external blocklist. PhishDestroy has also listed the domain as blocked. Independent trust scoring from Gridinsoft rates the site at 0 out of 100, reinforcing the malicious assessment.

The public page title, "Abundant Fields Grass Cows - Sustainable Grass‑Fed Cattle Farming," does not match any known legitimate brand and appears unrelated to the underlying threat, indicating a possible lure to attract unsuspecting visitors. While the exact phishing vector (e.g., login page, credential‑stealing form) has not been observed, the combination of low trust scores, vendor detections, blocklist presence, and the deceptive agricultural title suggests a classic credential‑harvesting campaign. Defenders should block the domain at perimeter firewalls, update web filtering and DNS threat‑intelligence feeds with the indicator svvapcowfl.eu.com, and monitor for any outbound connections to the associated Cloudflare IP. Continued observation of the domain’s status and any re‑hosting attempts is recommended, as threat actors often reactivate offline infrastructure after remediation.