viser-credit[.]com

Analysis indicates that the domain www.viser-credit.com is currently active and serves a website with the title “Home – Viser Credit Union”. The site is secured with a Let’s Encrypt R12 certificate, suggesting recent TLS deployment. Registration data shows the domain was registered through TuringSign Inc. d/b/a Cosmotown. DNS resolution points to the IPv4 address 163.61.188.7, which geolocates to the United States (MIT). The authoritative nameservers are dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com and dns4.lytehosting.com, and the HTTP response returns status code 200. The domain appears on a single security blocklist and is listed by PhishDestroy, indicating that at least one trusted feed has flagged it. VirusTotal analysis reports 13 detections out of 91 scanners, confirming that multiple security products consider the domain malicious. The presence of a legitimate‑looking credit‑union name in the page title suggests an attempt to deceive users seeking financial services, although the exact malicious payload or credential‑harvesting mechanism has not been publicly disclosed. Uncertainty remains regarding the full scope of the campaign, the hosting provider’s involvement, and whether additional infrastructure (e.g., command‑and‑control servers) is associated with the same IP address. Defenders should block network connections to 163.61.188.7 and to the domain itself, monitor DNS queries for the listed nameservers, and incorporate the domain into web‑filtering and email‑gateway rules. Continuous re‑assessment is recommended, as the detection count may evolve and additional indicators could emerge.