veristenlabs[.]com

Analysis indicates that veristenlabs.com was registered on February 21, 2026 through GoDaddy.com, LLC and immediately pointed to the IPv4 address 34.149.87.45, which belongs to Google LLC (AS396982). The site serves a TLS certificate issued by Let’s Encrypt (R13) and redirects all HTTP requests with a 301 response to the same host, suggesting a single‑page landing page typical of credential‑harvesting campaigns. The hosting environment shows a stack built on Wix with a React front‑end, supplemented by Lodash, HSTS enforcement, Google Cloud CDN, and HTTP/3 support. Nameserver delegation to ns35.domaincontrol.com and ns36.domaincontrol.com confirms the GoDaddy registration. Mail exchange is handled by Zoho (mx.zoho.com, mx2.zoho.com) which is unrelated to the observed web content, indicating the domain may also be used for email‑based lures. Reputation services flag the domain as highly malicious. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal records three positive detections out of ninety‑five scanned vendors. The domain appears on one public blocklist and is explicitly blocked by the PhishDestroy feed, yet it remains active as of the report date. The threat classification is listed as generic_phishing with a high risk rating, matching the observed infrastructure that is commonly employed for credential‑stealing pages. Uncertainty remains around the exact payload delivered to victims, as no malware samples or URLs have been disclosed. Defenders should therefore treat any traffic to veristenlabs.com as malicious. Recommended actions include adding the domain to network deny lists, configuring email gateways to reject messages originating from the listed Zoho MX hosts when paired with suspicious content, and monitoring for similar Wix‑based deployments that use Let’s Encrypt certificates on Google Cloud IP space. Continuous re‑evaluation is advised in case the site changes its hosting or certificate parameters.