security-auth-hvcu[.]xyz

The domain security-auth-hvcu.xyz was observed hosting a page titled “Secure System Transfer”. The site resolved to IP 91.202.233.156, which is registered to AS200593 PROSPERO OOO in Russia. According to the current intelligence, the domain was created on 21 February 2026 and is presently taken offline. The SSL certificate presented is identified as R13, indicating a self‑signed or low‑trust certificate. Reputation services assign a Gridinsoft trust score of 0 / 100 and a Scamadviser score of 26 / 100, both reflecting a high likelihood of malicious intent.

VirusTotal analysis shows that 13 of 95 scanned security vendors flagged the domain, confirming suspicious activity. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy filtering service. No additional public blocklist, Safe Browsing, OTX, or registrar data were supplied. The page title suggests the site attempts to portray a legitimate “Secure System Transfer” service, but no further content details are available.

Because the infrastructure points to a Russian hosting provider and the trust scores are near the bottom of their scales, defenders should treat the domain as hostile. Recommendations include adding the hostname to local deny lists, enforcing DNS‑based blocklists that contain the entry, and monitoring outbound connections to 91.202.233.156 for any residual traffic. Continuous re‑scanning with multi‑vendor platforms is advised to detect any changes in detection status. Organizations should also educate users about unsolicited messages that reference “Secure System Transfer” and instruct them to verify URLs before entering credentials.