relvo83[.]top

This domain is identified as a credential harvesting phishing site targeting user login credentials. Analysis indicates it presents a fake authentication interface designed to mimic legitimate services, tricking visitors into submitting sensitive account details such as usernames, passwords, and potentially multi-factor authentication codes. The domain's infrastructure and rapid takedown suggest a short-lived but high-impact operation typical of targeted phishing campaigns. Evidence supporting this assessment includes detection by 20 out of 95 security vendors on VirusTotal, indicating broad recognition of malicious intent. The domain was registered on February 26, 2026, with an SSL certificate issued by a low-trust provider (R13), a common indicator of phishing infrastructure. It appears on one security blocklist and resolves to the IP address 47.77.229.72, hosted on Alibaba's US infrastructure (AS45102). The page title 'Loading' further suggests an attempt to mask malicious activity behind a generic placeholder. Users who visited relvo83.top should immediately revoke any entered credentials from associated accounts, particularly if the site mimicked a known service. Enable multi-factor authentication on all critical accounts and monitor for unauthorized access or transactions. If credentials were reused across multiple platforms, update passwords on all affected services to prevent lateral compromise. Network administrators should block the domain and IP (47.77.229.72) at the perimeter to prevent further exposure. Given the domain's current offline status, the threat window is likely closed, but residual risk remains for users who interacted with the site prior to takedown.