online[.]avivaelevators[.]com

online.avivaelevators.com is an active brand‑impersonation domain targeting the Linea brand. The zone was registered through GoDaddy.com, LLC on 28 February 2026 and is currently hosted on the IP address 190.92.174.32, which belongs to AS199404 WHG Hosting Services Ltd in India. The server presents a Let’s Encrypt R12 certificate and resolves via four authoritative name servers (ns1.mysecurecloudhost.com through ns4.mysecurecloudhost.com). HTTP responses return a 403 Forbidden status and the page title is reported as “403 Forbidden”. The web stack includes LiteSpeed and HTTP/3, while the Gridinsoft trust score is recorded as 0 / 100, indicating a lack of reputation.

VirusTotal analysis shows that 12 of 95 scanned security vendors flag the domain as malicious, and the site appears on a single blocklist managed by PhishDestroy. The overall risk rating is high and the campaign is classified as brand impersonation. The limited public evidence consists of the HTTP status, certificate details, and infrastructure attributes; no payload or credential‑harvesting page has been observed.

Because the site returns only a 403 response, the actual malicious content, if any, remains unobserved. It is unclear whether the domain hosts a live phishing form, redirects to a secondary host, or serves malicious binaries. No additional indicators such as phishing email samples, command‑and‑control endpoints, or malware hashes have been disclosed.

Defenders should block traffic to 190.92.174.32 and to the domain online.avivaelevators.com at perimeter and DNS layers. Continuous monitoring of the associated name servers and the WHG Hosting Services network is advised to detect any future activation. Incident response teams handling Linea‑related credentials should treat any unsolicited communications referencing this domain as suspicious and enforce verification procedures. Updating threat‑intel feeds with the observed indicators will improve detection across security controls.