veriftools[.]fan

www.veriftools.fan is currently listed as an active generic phishing site. The page returns HTTP 200 and the title "VerifTools Fans" was observed, but the payload has not been publicly disclosed. The domain resolves to 188.114.96.3, an address owned by Cloudflare, Inc. located in Canada, and the TLS certificate is issued by Google Trust Services under the WE1 authority, indicating a valid HTTPS endpoint. Infrastructure fingerprints show the use of PHP, Vue.js, and a Hostinger hosting environment, with Cloudflare Browser Insights and HTTP/3 enabled.

Registration data reveals the domain was created through Eranet International Limited, and the authoritative nameservers are marissa.ns.cloudflare.com and zac.ns.cloudflare.com. The domain has been added to at least one security blocklist and is flagged by PhishDestroy as malicious. VirusTotal has recorded scans by 91 vendors, none of which have raised a detection, but the absence of a flag does not constitute proof of benign intent. No additional threat‑intel sources such as OTX or Google Safe Browsing are referenced in the supplied data.

Because the observed title and infrastructure are consistent with known phishing deployments and the domain is actively listed on blocklists, defenders should treat www.veriftools.fan as hostile. Recommended actions include immediate network‑level blocking, adding the domain to URL filtering policies, monitoring DNS queries for the associated IP addresses, and continuing to collect payload samples for deeper analysis. Further investigation of the site content and any credential‑capture mechanisms is required to fully characterize the attack vector.