perexodnuk[.]luxteam[.]live

This domain is flagged as an elevated-risk credential theft operation. Analysis indicates the infrastructure is designed to harvest user login credentials through deceptive interfaces, likely mimicking legitimate services to trick victims into submitting sensitive information. The use of a modern frontend framework (Vite + React) suggests an attempt to appear authentic, while backend components (Python, Uvicorn) may facilitate data exfiltration. Infrastructure analysis reveals multiple high-confidence indicators. The domain perexodnuk.luxteam.live was registered on November 24, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains. It resolves to IP address 79.133.181.64 and holds a Gridinsoft trust score of 0/100. Security vendors on VirusTotal flagged the domain with 4 detections out of 95, and it appears on 2 security blocklists, including PhishDestroy and OISD. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. The domain is currently offline, but prior activity aligns with credential theft campaigns. To mitigate risks associated with credential theft, users should verify domain authenticity before entering login details, particularly if redirected from unsolicited links. Organizations should implement multi-factor authentication (MFA) to reduce the impact of stolen credentials. Security teams are advised to block the domain and its associated IP (79.133.181.64) at the network level, and monitor for related indicators of compromise (IoCs) such as unusual login attempts or data exfiltration patterns. If credentials were entered on this domain, immediate password resets and account audits are recommended.