thevista[.]in

This domain, thevista.in, is actively flagged as a high-risk brand impersonation phishing site targeting the brand 'Across.' Infrastructure analysis reveals the domain was registered on January 19, 2022, through a major registrar and is currently resolving to the IP address 162.241.85.198, hosted on an autonomous system based in the United States. The site returns an HTTP 200 status, indicating it is operational and serving content, with the page title displayed as 'The Vista.' The domain is associated with nameservers rns23.webhostbox.net and rns24.webhostbox.net, and SSL certification is provided by a widely recognized certificate authority, which does not mitigate its malicious classification. The domain appears on multiple security blocklists, including two independent sources, and is flagged by 12 out of 95 security vendors on a prominent threat intelligence platform. Additionally, it is referenced in 15 threat intelligence pulses, suggesting persistent and recognized malicious activity. The hosting infrastructure employs Nginx and OpenResty, technologies commonly used for both legitimate and malicious purposes, though their presence here aligns with known phishing site deployments. The domain’s trust score is assessed at 0 out of 100, reinforcing its classification as a confirmed threat. While the exact content of the site has not been manually reviewed, the available data confirms its intent to impersonate the 'Across' brand, a detail explicitly noted in threat intelligence records. Defenders should treat this domain as an active threat, blocking resolution at the DNS level and monitoring for any attempts to access it within their networks. Given its persistence since early 2022 and continued activity, it is unlikely to be taken down without intervention. Organizations should also review logs for any prior interactions with this domain and assess potential exposure or credential harvesting risks associated with its use.