tivkana[.]sbs

This domain, tivkana.sbs, is flagged as a high-risk credential theft operation specifically impersonating Microsoft services. Analysis indicates the infrastructure is designed to harvest login credentials through deceptive login portals, a tactic commonly associated with account takeover schemes and subsequent unauthorized access to corporate or personal data. The threat type is narrowly classified as brand impersonation with credential theft objectives, not generic phishing, due to its targeted mimicry of Microsoft authentication workflows. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain was registered on June 17, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to IP address 104.21.20.152, hosted under AS13335 (Cloudflare, Inc.), a network often leveraged to obscure malicious origins. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy. Security vendors on VirusTotal flag the domain at 14/95 detections, and it appears on one security blocklist, specifically PhishDestroy. The creation date discrepancy (2026) suggests potential domain spoofing or incorrect registry data, further complicating attribution. Mitigation steps must focus on disrupting the credential theft lifecycle. Network-level blocking of the domain and its resolving IP (104.21.20.152) is recommended for enterprise environments. Endpoint protection should be configured to detect and quarantine any processes attempting to interact with tivkana.sbs or its associated infrastructure. User education should emphasize the risks of entering credentials on untrusted portals, particularly those mimicking Microsoft login pages. Organizations should enforce multi-factor authentication (MFA) to mitigate the impact of stolen credentials. Continuous monitoring for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or resolving to Cloudflare IP ranges is advised to preemptively identify related threats.