maraeveltesse[.]live

PhishDestroy identifies maraeveltesse.live as an active credential theft domain under investigation, with no detections on VirusTotal despite exhibiting phishing behaviors. The domain impersonates generic login portals to harvest user credentials, posing a moderate but evolving risk to unsuspecting victims. Current telemetry suggests opportunistic targeting rather than highly tailored brand impersonation, though this may change as additional artifacts emerge.

The domain was registered on May 07, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP 172.67.180.238. It leverages a Let's Encrypt SSL certificate to enhance legitimacy, but currently shows 3/95 detections on VirusTotal, indicating it remains under the radar of most security vendors. No known entries in public blocklists have been observed at this time, and the domain's age suggests it is still in early operational phases. Trust scores for the registrar and IP are neutral, with no prior association to malicious activity noted in historical datasets.

Organizations should immediately block maraeveltesse.live at the network perimeter and DNS level to prevent access. Users who may have interacted with the domain should reset credentials used on the platform, enable multi-factor authentication where available, and monitor for follow-on phishing attempts. Security teams are advised to hunt for additional infrastructure linked to this domain, particularly focusing on similar SSL certificates or registrar patterns, and to report any observed activity to threat intelligence platforms for collective defense. Given the domain's recent creation and low detection rate, rapid containment is critical to limit potential impact.