web[.]vaynera[.]one

The domain web.vaynera.one was registered through Spaceship, Inc. on 2026-03-06 and is hosted on Cloudflare infrastructure, resolving to IP address 104.21.85.42 within AS13335 (Cloudflare, Inc.) located in the United States. The authoritative nameservers are jim.ns.cloudflare.com and aliza.ns.cloudflare.com, and the site presented a valid Let's Encrypt SSL certificate issued by the E7 intermediate. HTTP requests to the site return a 403 status code, and the page title returned by the server is “Suspected phishing site | Cloudflare”. Google Safe Browsing classifies the domain as a social engineering threat, and VirusTotal records indicate that 14 of 94 security vendors have flagged the domain as malicious.

The domain is listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Current operational status is offline, as indicated by the “taken offline” flag in the intelligence feed. Analysis confirms that the domain was used for a generic phishing campaign, although the specific target or lure details have not been disclosed.

Uncertainty remains regarding the exact content that was served before takedown, as no visual or functional analysis is available. Defenders should continue to block the domain at network perimeters, add the associated IP address to deny lists, and monitor for any re‑registration or similar domains using the same registrar or Cloudflare nameservers. Ongoing threat‑intel correlation is advised to detect potential reuse of the observed infrastructure in future campaigns.