bogpls-vdplusss[.]st

Analysis of the domain bogpls-vdplusss.st indicates it was actively used for generic phishing operations before being taken offline on or before July 22, 2026. The domain resolved to the IP address 45.156.87.63, hosted on infrastructure associated with AS51396 (Pfcloud UG) in the Netherlands. At the time of assessment, the page displayed a Spanish-language title, 'Sitio en Mantenimiento,' which may suggest targeting Spanish-speaking users or serving as a placeholder during operational downtime. The domain was registered on March 8, 2026, through StanCo and Istanco, with nameservers ns1.istanco.com and ns2.istanco.com, indicating a potential link to known bulletproof hosting providers.

Technical indicators reveal the use of Ubuntu and Apache HTTP Server, alongside a Let's Encrypt SSL certificate (serial number E8), which is commonly exploited by threat actors to lend legitimacy to malicious sites. Detection data shows the domain was flagged by three of 95 security vendors on VirusTotal, though the specific nature of the phishing content remains unconfirmed. It was also listed on one security blocklist and blocked by PhishDestroy, reinforcing its classification as malicious infrastructure. Gridinsoft assigned a trust score of 0/100, further corroborating its high-risk status.

Defenders should treat this domain as part of a broader phishing campaign, particularly given its hosting on an IP range historically linked to malicious activity. While the exact brand or service impersonated is not identified in available data, the 'maintenance' page title may have been used to deceive users into believing the site was temporarily unavailable, potentially lowering their guard for follow-up attacks. Network defenders are advised to block the domain and its associated IP at the perimeter, monitor for related domains registered through the same registrar or nameservers, and review logs for prior connections to 45.156.87.63.