tavron-luxora[.]com

Analysis of tavron-luxora.com indicates a high‑risk, active phishing infrastructure. The domain was registered on 2026‑02‑21 through NETIM SAS and resolves to the IPv4 address 94.26.38.9, which belongs to AS202412 owned by Omegatech LTD in Bulgaria. Authoritative nameservers ns1.netim.net, ns2.netim.net, and ns3.netim.net are in use. The web server reports Nginx with OpenResty and IPinfo components, serves a valid Let's Encrypt certificate (E8), and returns HTTP 200 for the root URL. The page title observed is “Oficiální webové stránky Tavron Luxora | 2026”. VirusTotal records 17 detections out of 95 scanning engines, and the domain appears on three public blocklists. It is also listed in a single AlienVault OTX pulse and has been blocked by PhishDestroy, MetaMask, and SEAL. Google Safe Browsing flags the domain for SOCIAL_ENGINEERING. Gridinsoft assigns a trust score of 0 / 100. While the visible content has not been manually inspected, the convergence of multiple detections, blocklist listings, and a low trust score strongly suggests a phishing operation targeting users of the purported “Tavron Luxora” site. Defenders should block or sinkhole the domain, monitor DNS queries for the associated nameservers, and apply URL filtering based on the reported indicators. Further investigation of the hosted page content is recommended to confirm the exact credential‑capture tactics employed.