app[.]vvsfi[.]net

This domain is flagged as a credential harvesting phishing endpoint targeting users through deceptive login interfaces. Analysis indicates the infrastructure was designed to mimic legitimate authentication portals, likely distributing stolen credentials to unauthorized third parties. The domain exhibits characteristics consistent with large-scale phishing campaigns, including the use of content delivery networks to obscure origin servers and evade detection. Evidence supporting this assessment includes detection by 3 of 95 security vendors on VirusTotal, registration through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 14, 2026, and presence on one security blocklist. The domain resolves to IP address 188.114.96.3 and employs Cloudflare with HTTP/3 protocol support, suggesting an attempt to leverage modern web technologies for obfuscation. The creation date in 2026 is anomalous, indicating potential domain spoofing or incorrect WHOIS records, a common tactic in phishing operations. Users who visited app.vvsfi.net should immediately revoke any entered credentials, particularly for financial or corporate services. Monitor accounts for unauthorized access and enable multi-factor authentication where available. Network administrators should block the domain and associated IP address 188.114.96.3 at the perimeter. If browser sessions were active during the visit, clear all cached data and run a full antivirus scan to detect potential malware delivered through the phishing page. Report the incident to relevant security teams for further investigation and threat correlation.