lvvas[.]com

The domain lvvas.com is currently classified as a high‑risk generic phishing site. HTTP requests return a 200 OK response and the page title is reported as “lvvas”, indicating an active web presence. The site remains listed as active on the observation date of 12 July 2026. Registration data shows the domain was created on 11 March 2017 through Gname.com Pte. Ltd. DNS resolution points to the Cloudflare address 172.67.176.79, which is advertised as belonging to AS13335 (Cloudflare, Inc.) and is located in the United States. The authoritative nameservers are lady.ns.cloudflare.com and zod.ns.cloudflare.com, and the TLS certificate is a Let’s Encrypt certificate identified as “YE2”. Mail exchange is directed to mail.emb666.com with priority 1, suggesting a separate mail infrastructure possibly used for credential harvesting. Threat intelligence sources have identified the domain in two AlienVault OTX pulses and it appears on three external blocklists. It is currently blocked by three independent filtering services (PhishDestroy, MetaMask, SEAL). VirusTotal reports four out of ninety‑five security vendors flagging the domain as malicious, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. Public content analysis is limited to the generic page title; no specific brand or credential‑collection page has been captured, so the exact phishing lure remains unknown. The low vendor detection count on VirusTotal may reflect limited sampling rather than benign behavior, and the presence of a legitimate TLS certificate does not mitigate the risk. Defenders should add lvvas.com to deny‑list configurations for web traffic and email gateways, monitor DNS queries for the associated IP and nameservers, and enforce TLS inspection to detect any credential‑submission attempts. Continuous re‑evaluation of blocklist status and periodic scanning of the host for content changes are advised.