vivatradesfunds[.]com

Analysis of vivatradesfunds.com indicates a high-risk phishing domain actively targeting financial services users. The domain was registered on March 11, 2026, through OwnRegistrar, Inc., a registrar frequently associated with fraudulent infrastructure. It resolves to IP address 192.142.1.134, hosted on AS214036 (Ultahost, Inc.) in the Netherlands, a network segment previously observed in credential-harvesting campaigns. The page title, 'Viva Trade Funds | Home,' suggests an attempt to impersonate a legitimate investment or trading platform, though no specific brand confirmation has been independently verified beyond the title. Detection metrics reveal limited but consistent flagging: nine security vendors on VirusTotal classify the domain as malicious, and it appears on at least one security blocklist, including PhishDestroy.

The domain employs a Let's Encrypt SSL certificate (serial E8), a common tactic among phishing sites to simulate legitimacy. HTTP response status is 200, confirming the site remains operational as of the report date. Nameservers ns1.thekinsmenservers.com and ns2.thekinsmenservers.com are linked to other suspicious domains, further indicating coordinated abuse. Technologies detected include Bootstrap, jQuery, and JivoChat, which may facilitate dynamic content delivery and real-time interaction—common features in phishing kits designed to deceive users. The Gridinsoft trust score of 0/100 aligns with the observed malicious indicators.

While the exact phishing kit or payload remains unconfirmed, the combination of registration patterns, hosting provider, and detection counts strongly suggests this is an active credential-harvesting or investment scam operation. Defenders should treat this domain as malicious and implement blocking at the DNS or network level. Monitoring for related domains registered through OwnRegistrar or resolving to the same IP range (192.142.1.0/24) is recommended.