vbf5hh[.]christmas

This domain, vbf5hh.christmas, is under investigation for phishing activity following its appearance on a single security blocklist maintained by PhishDestroy. Registered on July 15, 2026, through Spaceship, Inc., the domain remains active as of July 22, 2026, with no takedown or suspension observed. Infrastructure analysis reveals it resolves to the IP address 47.242.217.10 and utilizes nameservers launch1.spaceship.net and launch2.spaceship.net, indicating hosting through the registrar’s infrastructure. The domain has been scanned by 95 security vendors via VirusTotal, none of which currently flag it as malicious; however, the absence of detections does not confirm safety, particularly given its recent registration and blocklist inclusion.

Defenders should note that the domain’s registration age—just seven days old at the time of this report—aligns with common phishing timelines, where newly created domains are frequently leveraged for short-term campaigns. The lack of widespread detection may reflect limited exposure or evasion techniques rather than benign intent. No additional context is available regarding the specific phishing kit, targeted brand, or content hosted on the domain, as the page title and exact scam type remain unanalyzed. The IP address 47.242.217.10 has not been cross-referenced with other known malicious infrastructure in this assessment, though further pivoting on the hosting provider and ASN could yield additional indicators.

Organizations are advised to treat this domain with caution, particularly if it appears in inbound emails, SMS messages, or redirect chains. Blocking or monitoring access to vbf5hh.christmas is recommended pending further analysis, especially for sectors frequently targeted by phishing campaigns. If internal logs or user reports indicate interaction with this domain, defenders should examine associated payloads, credentials, or secondary domains for lateral movement.