revonixa[.]pro

The domain revonixa.pro has been identified as a credential harvesting site specifically targeting Microsoft users. Analysis indicates this domain operated as a brand impersonation threat, designed to deceive users into disclosing sensitive login credentials by mimicking legitimate Microsoft authentication portals. As of the latest assessment, the domain is offline, though prior activity and infrastructure analysis confirm its malicious purpose. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered through Dynadot Inc on May 06, 2026, an unusual future date suggesting potential domain spoofing or registry manipulation. It resolved to the IP address 104.21.1.54 and employed Cloudflare services, including Cloudflare Browser Insights and HTTP/3, to obfuscate its origin and evade detection. Security vendors flagged revonixa.pro as malicious, with 5 of 95 VirusTotal engines detecting it as a threat. The domain held a Gridinsoft trust score of 0/100 and appeared on one security blocklist, further corroborating its fraudulent nature. The SSL certificate was issued by Google Trust Services, a common tactic used to lend false legitimacy to phishing sites. Current status indicates the domain has been taken offline, likely due to enforcement actions or abandonment by threat actors. However, the infrastructure and registration details remain relevant for historical and forensic analysis. Organizations are advised to block the domain and its associated IP address at the perimeter level. Security teams should monitor for any re-registration attempts or similar domains using the same registrar or IP range. End users who may have interacted with revonixa.pro should be instructed to reset their Microsoft credentials immediately and enable multi-factor authentication. Proactive threat hunting for related indicators of compromise, such as the domain creation date and Cloudflare usage patterns, is recommended to identify potential lateral movement or persistent access.