l7srv[.]su

Threat analysis: L7srv.su is an active phishing domain engineered to steal user credentials by masquerading as a legitimate login portal. Its domain name suggests ties to service-layer infrastructure, which can trick visitors into trusting it. Security vendors already flag it heavily, confirming it is not a false alarm. How we know: This domain was created on July 24, 2025, only days ago, and is already resolving to 172.67.75.115. It was registered through REGRU-SU, a registrar that does not automatically block clearly malicious registrations. VirusTotal reports 17 out of 95 security engines now detect l7srv.su as malicious, a high ratio for such a new domain. Safety guidance: If you visited the site, stop using any passwords typed there. Even though it uses a Let’s Encrypt SSL certificate, that only proves the connection is encrypted, not that the site is safe. Clear your browser cache and cookies immediately, then run a full antivirus scan on your device. Change passwords for any accounts you might have entered, starting with email and banking accounts. Enable two-factor authentication everywhere possible to prevent reuse of stolen credentials. Monitor bank statements and watch for unexpected password reset emails. When in doubt, navigate directly to known-good URLs instead of clicking links.