servoauth2[.]live

servoauth2.live is a newly registered domain (creation date 27 July 2026) that has been observed in active phishing infrastructure. The domain resolves to the IP address 172.67.153.85, which is part of Cloudflare’s network and is served by the authoritative nameservers jo.ns.cloudflare.com and lex.ns.cloudflare.com. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain currently appears on one security blocklist and has been specifically blocked by the PhishDestroy feed, indicating that at least one anti‑phishing service has identified malicious use.

VirusTotal has processed the domain with 91 scanning engines; at the time of analysis none of the engines reported a detection. The absence of detections does not imply benign behavior, especially given the recent creation date and the presence on a blocklist. No public information is available regarding SSL certificate details, HTTP response codes, page title, or any observed payload. Consequently, the exact content hosted on servoauth2.live remains unverified.

The limited data set leaves several uncertainties: the specific phishing campaign or targeted brand has not been disclosed, the hosting environment beyond Cloudflare’s edge network is unknown, and there is no evidence of additional infrastructure such as command‑and‑control servers or credential‑stealing pages. Analysts should monitor DNS queries for the domain, collect any future HTTP responses, and correlate traffic with known phishing indicators. Defenders are advised to add servoauth2.live to local blocklists, enforce outbound filtering for connections to the associated IP, and continue to watch for updates from threat‑intel feeds that may provide further context or payload samples.