lvvas[.]net

Analysis of lvvas.net confirms its classification as an active generic phishing domain, operational since February 25, 2026. The domain resolves to 172.67.148.109, hosted on Cloudflare's infrastructure (AS13335), a common pattern observed in phishing campaigns leveraging content delivery networks to obscure origin servers. The site presents a minimal page title 'lvvas' with no additional branding or context, a tactic frequently employed to avoid immediate detection by automated crawlers while maintaining functionality for targeted phishing links. Infrastructure indicators reveal the domain was registered through Gname.com Pte. Ltd., a registrar historically associated with higher volumes of malicious domains. The SSL certificate, issued by Let's Encrypt (YE1), provides encryption but does not validate legitimacy, as phishing sites routinely use free certificates to appear secure. Detection by multiple security blocklists—including PhishDestroy, MetaMask, and SEAL—along with its presence in two AlienVault OTX threat intelligence pulses, corroborates its malicious classification. Only one of ninety-five security vendors on VirusTotal currently flags the domain, suggesting either recent activation or evasion techniques targeting specific detection mechanisms. The domain's nameservers (lady.ns.cloudflare.com and zod.ns.cloudflare.com) are consistent with Cloudflare-protected phishing sites, which often rotate DNS configurations to complicate takedown efforts. While the exact phishing kit or targeted brand remains unconfirmed, the site's generic presentation aligns with credential-harvesting campaigns where victims are redirected or tricked into submitting login details. Defenders should treat this domain as high-risk and prioritize blocking at the DNS or network layer. Monitoring for subdomains or newly associated IP addresses is recommended, as phishing operators frequently shift infrastructure to maintain persistence.