vstr[.]vestra-dao[.]info

Analysis of the domain vstr.vestra-dao.info, observed on July 24, 2026, indicates that it was employed as a generic phishing infrastructure targeting users of VestraDAO. The site presented the page title “Overview – VestraDAO”, suggesting an attempt to appear as an official VestraDAO page. Technical resolution points to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. and is geolocated to Canada. Registration was performed through Spaceship, Inc., and the domain is delegated to Cloudflare name servers rafe.ns.cloudflare.com and abdullah.ns.cloudflare.com.

The domain has been listed on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer, confirming its malicious reputation. VirusTotal analysis recorded three positive detections out of ninety‑one scanning engines, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the assessment of high risk. The site employed a Let’s Encrypt certificate (E7), providing valid TLS encryption but offering no mitigation against the underlying content abuse. Current HTTP status shows the domain as taken offline, yet the infrastructure—particularly the Cloudflare‑hosted IP—remains reusable for future campaigns.

Uncertainty remains regarding the exact content served before takedown, as no visual or functional analysis is available beyond the page title. Defenders should continue to block the domain at network perimeter, monitor the associated IP address for reuse, and add the domain to internal blocklists. Additional vigilance is advised for newly created subdomains under the same registrar or name‑server configuration, as the same threat actor may replicate the pattern. Regular re‑query of VirusTotal and other multi‑engine scanners is recommended to capture any re‑activation.