vrbhilfe[.]info

The domain vrbhilfe.info was observed on July 12, 2026 and classified as a high‑risk generic_phishing site. The service returns an HTTP 301 redirect and the displayed page title is “Server Not Found”, indicating a possible placeholder or a deliberately broken landing page used to evade content‑based detection. The domain remains active despite being listed on a security blocklist. Infrastructure analysis shows the domain resolves to the single IPv4 address 85.11.167.252, which is geo‑located to Bulgaria and associated with the Speedy network. Registration was performed on April 21, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the authoritative name servers are a.dnspod.com and b.dnspod.com. The TLS certificate is issued by ZeroSSL GmbH under the ZeroSSL RSA DV SSL CA 2, a free certificate authority frequently used by malicious operators to obtain valid‑looking HTTPS. Threat intelligence sources corroborate the malicious nature of the domain. It appears on one publicly published blocklist and is flagged by PhishDestroy. The Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation. VirusTotal analyses report that seven of ninety‑five scanning engines have generated a detection for the domain, and AlienVault OTX contains a single pulse referencing it. These signals collectively confirm active phishing activity. Defenders should add vrbhilfe.info to network‑level deny lists and enforce URL filtering policies that block any HTTP or HTTPS request to this host. Continuous monitoring of DNS queries for the associated IP address and the dnspod name servers can help identify potential replication of the infrastructure. Where possible, sinkholing the IP or redirecting traffic to a controlled response page may reduce user exposure while providing additional telemetry.