open-vpp[.]icu

PhishDestroy identifies open-vpp.icu as an active tech support scam server, posing as a legitimate VPP service portal to deceive users into divulging personal or financial data. The threat level is under investigation, but its recent creation and low detection rate demand immediate scrutiny. This domain was flagged with 0 detections out of 95 VirusTotal scans, indicating a low initial catch rate by security vendors despite its malicious intent. The domain open-vpp.icu was registered on April 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar with no established reputation for proactive abuse mitigation. It resolves to the IP address 104.21.31.51 and is secured with a Let’s Encrypt SSL certificate, a common tactic to enhance trustworthiness in phishing campaigns. As of now, this domain remains unlisted on major threat intelligence blocklists and carries no public trust scores from organizations like Google Safe Browsing or PhishTank. Its recent registration and clean SSL certificate suggest a rapidly deployed threat designed to evade early detection. To mitigate exposure to this tech support scam, users should avoid accessing open-vpp.icu or any subdomains associated with it. Organizations are advised to implement DNS filtering and block the IP 104.21.31.51 at the network perimeter. If interaction has already occurred, reset passwords linked to the account used on the site, scan devices for malware, and report the domain to your IT security team and local cybercrime units. Monitoring for related domains registered with NICENIC INTERNATIONAL GROUP CO., LIMITED may help prevent further campaign expansion.