runovex[.]com

PhishDestroy identifies runovex.com as an active generic phishing domain currently under investigation for credential theft operations. The domain remains accessible and unresolved, posing an immediate risk to users who may encounter fraudulent login prompts or forms masquerading as legitimate services. No specific brand impersonation has been confirmed at this stage, but the infrastructure suggests opportunistic exploitation of trust in domain naming conventions.

This domain was flagged by 17 of 95 VirusTotal vendors as of the latest scan, indicating a low detection rate despite clear malicious intent. The domain was registered through Fewmoretaps OU d/b/a Trustname.com on April 02, 2026, and resolves to IP address 188.114.97.3. It operates with a valid Let's Encrypt SSL certificate, enhancing its credibility to potential victims. Despite its recent creation, the domain has already been identified by multiple threat intelligence platforms due to anomalous behavior patterns linked to phishing toolkits.

The current status of runovex.com remains active, with no confirmed takedown as of this report. Users are strongly advised to avoid interacting with this domain or any associated URLs. Organizations should implement network-level blocking of the IP address 188.114.97.3 and the domain runovex.com in DNS and firewall configurations. Immediate reporting to internal security teams and external threat intelligence platforms is recommended to prevent further propagation. Enhanced user awareness training should emphasize scrutiny of recently registered domains and validation of SSL certificates, particularly those issued by automated providers like Let's Encrypt.