cocaine-vhq[.]com

PhishDestroy identifies cocaine-vhq.com as an active generic phishing domain designed to deceive users into disclosing sensitive information under false pretenses. The domain does not explicitly impersonate a specific brand, suggesting a broader, opportunistic phishing campaign aimed at harvesting credentials or payment details through spoofed login portals or fake services. No drainer kit artifacts were detected in open-source intelligence at the time of analysis, but the infrastructure aligns with common phishing toolkits leveraging generic domains to evade detection.

Technical indicators confirm elevated risk: VirusTotal detection ratio stands at 7 out of 95 vendors, the domain was registered via NICENIC INTERNATIONAL GROUP CO., LIMITED on March 12, 2025, and resolves to IP 168.222.183.248. The SSL certificate, issued by Let's Encrypt, indicates an attempt to mimic legitimate HTTPS encryption standards. Google Safe Browsing (GSB) has not yet flagged the domain, and blocklist aggregators report minimal prior listings, underscoring its recency and potential for rapid deployment in active campaigns.

The domain remains active and unmitigated as of this report. Users should avoid all interactions with cocaine-vhq.com and report it to their security teams or through platforms like VirusTotal. Blocking the domain at the network perimeter and updating firewall rules to deny traffic to 168.222.183.248 is recommended. Given its recent registration and low initial detection rates, the remaining risk is elevated, with potential for rapid escalation as more threat intelligence is gathered.