messenger-verification-worsk[.]site

The domain messenger-verification-worsk.site has been identified as a credential theft operation. Analysis indicates the site masquerades as a legitimate verification portal to harvest user login credentials, likely targeting messaging or social media accounts. The domain is currently offline, but prior activity suggests active exploitation attempts. Infrastructure analysis reveals the domain was flagged by 5 of 95 security vendors on VirusTotal, registered through HOSTINGER operations, UAB, and resolved to the IP address 203.171.27.189. The domain was created on June 15, 2026, an anomalous future date suggesting potential registry manipulation or typo-squatting tactics. It appears on three security blocklists, and third-party trust scoring systems (e.g., Gridinsoft) assigned it a 0/100 trust rating. The page title, 'Webcake | Chưa xuất bản,' further indicates an incomplete or deceptive deployment, typical of short-lived phishing campaigns. Current status confirms the domain is offline, but residual risk remains due to its prior inclusion in threat intelligence feeds. Organizations and users are advised to block the domain and associated IP (203.171.27.189) at the network level. Endpoint protection systems should be updated to include this indicator of compromise (IOC). Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window, particularly if multi-factor authentication was not enabled. Monitoring for related domains with similar naming patterns (e.g., 'messenger-verification-*') is recommended to preempt follow-up campaigns.