vcbg5d[.]shop

Analysis as of July 28 2026 indicates that the domain vcbg5d.shop is actively being used for a generic phishing campaign. The domain is delegated to the authoritative name servers launch1.spaceship.net and launch2.spaceship.net, which resolve to the single IPv4 address 47.242.217.10. This IP is currently listed by the PhishDestroy blocklist, and the domain appears on an additional security blocklist, confirming that at least two independent feeds consider it malicious. VirusTotal has recorded a single positive detection out of 91 scanned vendors, demonstrating that at least one antivirus engine has identified malicious behavior associated with the domain.

The limited detection count does not mitigate the risk, as the presence on multiple blocklists and the active status suggest ongoing abuse. No further infrastructure details such as ASN, hosting provider, or SSL certificate information are available in the supplied intelligence, leaving the broader hosting context uncertain. The lack of publicly disclosed page title or content analysis means the specific luring technique employed by the phishing site cannot be confirmed, but the classification as generic phishing aligns with the observed blocklist entries. Defenders should treat vcbg5d.shop as hostile.

Immediate mitigation steps include adding the domain and its resolved IP address to network‑level deny lists, configuring web‑proxy and DNS filtering solutions to block resolution, and ensuring endpoint security products are updated to include the latest definitions that flag the domain. Continuous monitoring of the name servers and the IP address is advised, as the infrastructure could be repurposed or expanded. Organizations that rely on email or credential‑based authentication should remain vigilant for phishing attempts that reference this domain, and incident‑response teams should isolate any traffic that originates from or is directed to it.