sv[.]morvanelithix[.]com

This domain, sv.morvanelithix.com, is identified as a credential theft operation designed to impersonate financial or corporate entities for the purpose of harvesting user login credentials. Analysis indicates the infrastructure lacks overt ties to known cryptocurrency drainer kits or payment redirection schemes, focusing instead on traditional credential harvesting through spoofed login portals. No specific brand impersonation has been conclusively linked to this domain, though the naming convention suggests an attempt to mimic legitimate financial or SaaS platforms. Infrastructure analysis reveals the domain was registered on April 30, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.203.88, a Cloudflare proxy endpoint commonly used to obfuscate hosting origins. Detection metrics show 19 of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on a single blocklist and is actively blocked by one security feed. Google Safe Browsing (GSB) status remains unconfirmed, though the domain's rapid detection rate suggests prior exposure. The domain has been taken offline, likely in response to detection and reporting. However, residual risk persists due to the registrar's history of hosting malicious infrastructure and the domain's recent creation date, which aligns with patterns observed in short-lived phishing campaigns. Users are advised to treat any prior interaction with this domain as compromised and to monitor for unauthorized access to associated accounts. Organizations should update blocklists to include the domain and IP, while security teams are recommended to analyze logs for connections to 172.67.203.88 during the period of activity.