vspmkxhi[.]click

The domain vspmkxhi.click was registered on February 21, 2026 through Global Domain Group LLC and uses the authoritative name servers ns1.globaldomaingroup.com and ns2.globaldomaingroup.com. DNS resolution points to the IPv4 address 82.152.64.210, which belongs to AS206300 YUNYOO LTD and is geolocated in the United Kingdom. Web‑server fingerprints identify Nginx as the front‑end and Vue.js as the client‑side framework; the only visible page title returned by the site is "登录", the Chinese term for "login". No TLS certificate was presented, indicating the service operated without HTTPS.

The site is currently taken offline, and its risk rating is elevated despite the offline status, reflecting the malicious intent observed during its active period. VirusTotal scans recorded 13 detections out of 93 security vendors, confirming that multiple independent scanners flagged the domain as malicious. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy service. While the page content has not been captured beyond the title, the combination of a login‑oriented title, lack of encryption, and the detection count aligns with a generic credential‑harvesting phishing campaign.

Uncertainty remains regarding the specific target audience or any additional payloads that may have been delivered while the site was live. Defenders should continue to block the domain and its resolving IP at network perimeters, monitor for any resurgence of the host, and include the IP's ASN in threat‑intel feeds. Because the site is offline, active exploitation is unlikely, but the infrastructure could be repurposed for future campaigns, so ongoing surveillance is advised.