dertvyn[.]com

Analysis of dertvyn.com shows multiple indicators of compromise consistent with a generic phishing operation. The domain was registered on November 2, 2025 through Dominet (HK) Limited, a registrar often used by malicious actors. It resolves to IP address 91.92.242.155, which is allocated to Omegatech LTD in the Netherlands (AS202412). No SSL/TLS certificate is presented, meaning traffic to the site would be unencrypted and vulnerable to interception.

The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy sinkhole, confirming that at least one threat‑intel platform has identified it as malicious. VirusTotal reports that 12 of 95 scanned security vendors flag the domain, providing additional corroboration of its suspicious nature. Gridinsoft assigns the domain a trust score of 0 out of 100, the lowest possible rating, indicating a high likelihood of abuse. The authoritative nameservers are annalise.ns.cloudflare.com, chris.ns.cloudflare.com, corey.ns.cloudflare.com, and an incomplete entry "fatim", all hosted on Cloudflare’s network, a common choice for fast‑flux or disposable phishing sites.

Current operational status is offline, which may be a temporary takedown or a deliberate avoidance of detection. No SSL certificate, no publicly available page title, and no evidence links have been disclosed, leaving the exact content of the site unknown. Defenders should continue to block the domain at perimeter defenses, monitor DNS queries for the listed Cloudflare nameservers, and add the IP address 91.92.242.155 to relevant blocklists. Ongoing observation of the registrar and hosting ASN is advised, as the infrastructure could be reused for future campaigns.