tvista-hub-api[.]tronvista-api[.]app

PhishDestroy flags tvistra-hub-api.tronvista-api.app as an active credential-harvesting domain under investigation for generic phishing. The domain mimics legitimate API hub services to trick users into submitting login credentials or sensitive tokens. No known brand impersonation or drainer kit association has been confirmed at this stage; however, the threat vector aligns with high-volume credential theft campaigns targeting unsuspecting users interacting with API gateway interfaces. This domain was created recently and exhibits minimal forensic footprint. VirusTotal currently returns 3/95 detections, indicating it remains under the radar of most security engines. The domain is registered through a privacy-protected registrar, obscuring ownership details. It resolves to IP 216.150.16.1, a hosting range associated with dynamic and potentially malicious activity. Google Safe Browsing (GSB) has not yet flagged the domain, and third-party blocklist counts remain at zero. The absence of historical detections suggests this is a newly deployed infrastructure, likely intended for short-lived phishing operations. WHOIS data shows a creation date within the last 30 days, consistent with rapid deployment tactics used by credential harvesters to evade detection. The domain is currently active and poses an immediate but contained risk. PhishDestroy has flagged it for ongoing monitoring and added it to the internal blocklist for affiliated threat intelligence platforms. Users are advised to block access to tvistra-hub-api.tronvista-api.app at the network level and avoid visiting the site due to the high likelihood of credential theft. While the current risk is evaluated as 'under_investigation', the lack of detections and recent creation date elevate the urgency for immediate preventative action. Security teams should monitor for related domains using the seed 4c6943 for pattern correlation. Remaining risk is moderate due to the domain's low profile and potential for rapid expansion into broader phishing campaigns.