vip[.]vuahox[.]com

On 7 August 2026, the domain vip.vuahox.com was flagged as an active generic phishing infrastructure with an elevated risk rating. DNS resolution returns the IPv4 address 64.7.198.11, indicating a single host serving the malicious content. The domain is listed on one public blocklist and is actively blocked by the PhishDestroy filtering service, confirming that at least one third‑party security provider has taken mitigation steps.

VirusTotal analysis shows that 13 of 91 scanned security engines have returned a positive detection for the domain, suggesting that a subset of AV products recognize it as malicious. No additional telemetry such as SSL certificate details, HTTP response codes, or registrar information is presently available in the intelligence feed, leaving the broader hosting context and ownership attributes unconfirmed. The limited detection footprint—one blocklist entry and a modest VirusTotal detection count—does not preclude the possibility of further propagation, and the active status indicates that the site may still be serving phishing content.

Defenders should continue to block the domain at network perimeter devices, update DNS sinkhole rules to include the resolved IP address 64.7.198.11, and incorporate the domain into endpoint threat‑intelligence feeds. Monitoring for any new listings on additional blocklists or an increase in VirusTotal detections is advised, as such changes would signal expanding exploitation. Incident response teams encountering traffic to vip.vuahox.com should treat the activity as malicious and follow standard phishing containment procedures, including user awareness alerts and forensic capture of associated network artifacts.