aevitasbk[.]com

This domain, aevitasbk.com, is currently flagged as an active high-risk phishing site targeting financial services. Infrastructure analysis reveals the domain was registered on September 3, 2025, through a hosting provider based in Germany, with an IP address of 159.100.6.5 under autonomous system AS214036. The domain resolves to nameservers ns1.ultahost.com through ns4.ultahost.com, and its MX records point solely to itself, a configuration often observed in phishing operations to intercept or redirect email communications. The SSL certificate is issued to an unrelated domain, globaloffshoremargin.com, which may indicate an attempt to obscure ownership or reuse compromised infrastructure. The domain has been detected by four security vendors on VirusTotal and appears on at least one security blocklist, reinforcing its classification as malicious. The page title, matching the domain name, suggests a generic banking or financial portal, though the exact content and targeted institution remain unconfirmed at this stage. The use of a recently registered domain, combined with hosting through a provider frequently associated with abusive activity, aligns with common phishing tactics designed to evade detection and maintain operational longevity. Defenders should treat this domain as hostile and prioritize blocking or monitoring any connections to 159.100.6.5 and its associated nameservers. Given the domain's active status and the presence of MX records, organizations should also assess whether internal email traffic is being directed to or through this infrastructure. The SSL certificate mismatch warrants further investigation, as it may indicate a broader pattern of domain or certificate abuse. While the specific phishing kit or payload is not yet identified, the domain's infrastructure and detection history provide sufficient evidence to classify it as a confirmed threat requiring immediate mitigation.