vpn-61[.]store

PhishDestroy has identified vpn-61.store as a brand impersonation threat with an elevated risk level. This domain specifically targets Facebook users, attempting to deceive them into believing they are interacting with a legitimate Facebook service. The site's page title, "Daftar Wingbet138 Resmi: Bergabung Sekarang & Nikmati Bonus Member Baru," further indicates a connection to an online gambling platform, which may be a lure to harvest credentials or personal information.

Investigation reveals that vpn-61.store was registered through NameCheap, Inc. on April 26, 2025, and resolves to IP address 172.67.165.99. Its SSL certificate is issued by Google Trust Services (WE1). VirusTotal shows 6 out of 95 security vendors flagging the domain as malicious, and it appears on one security blocklist. AlienVault OTX has included this domain in two threat intelligence pulses. The domain is currently offline, but it may reappear under a different name.

To protect against this threat, users should never enter credentials or personal information on any site that claims to be Facebook but has a suspicious URL like vpn-61.store. Always verify URLs by typing them directly into the browser rather than clicking links from emails or messages. Enable two-factor authentication on Facebook and report any phishing attempts to the platform. If credentials were entered, change passwords immediately and monitor accounts for unauthorized activity.