leviahub[.]registro-seguro[.]com

This domain, leviahub.registro-seguro.com, is currently flagged as an active credential-phishing site targeting users under the guise of 'Leviahub Spa,' as indicated by its page title. Infrastructure analysis reveals the domain was registered on May 5, 2026, through a major registrar, with hosting provided via AWS Global Accelerator, resolving to the IP address 99.83.217.1. The use of AWS infrastructure is consistent with many phishing operations due to its scalability and global reach, though it does not alone confirm malicious intent. The domain employs a Let's Encrypt SSL certificate (R12), which is commonly used by both legitimate and malicious sites to enable HTTPS, providing a false sense of security to potential victims. Nameservers are hosted by a reputable DNS provider, which may delay detection or takedown efforts, as these providers are frequently used by legitimate businesses. The domain appears on one security blocklist, and a single security vendor has flagged it as malicious, though the specific nature of the threat (e.g., credential harvesting, malware distribution) is not detailed in available intelligence. The HTTP status code of 200 confirms the site is currently accessible, and no evidence suggests it has been taken down or suspended. Defenders should prioritize this domain for further investigation, particularly to determine the exact phishing mechanism (e.g., fake login portal, fraudulent invoice submission) and any associated infrastructure, such as redirect chains or backend servers. Given the domain's recent registration and active status, it is likely part of an ongoing campaign. Network-level blocking or sinkholing is recommended for organizations until a full forensic analysis can be conducted. The lack of widespread detection does not indicate safety, as phishing domains often evade initial scans before being more broadly identified.