obscura-vpn[.]com

This domain, obscura-vpn.com, is currently offline and flagged as a generic phishing threat targeting VPN service users. Analysis indicates the domain was registered on November 16, 2025, through GoDaddy.com, LLC, and resolves to the IP address 18.208.88.157, hosted on Amazon.com, Inc. infrastructure (AS14618) in the United States. The domain is associated with four nameservers under NS1 (dns1.p04.nsone.net through dns4.p04.nsone.net), a configuration often seen in both legitimate and malicious setups. The SSL certificate is issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), which does not inherently indicate malicious activity but is commonly exploited in phishing campaigns to appear trustworthy. The page title, 'Obscura VPN | Privacy that’s more than a promise,' suggests an attempt to mimic a legitimate VPN provider, though no specific brand impersonation is confirmed from the available data.

As of the latest assessment, the domain returns an HTTP 404 status, indicating it is no longer serving content or has been taken down. It appears on one security blocklist (PhishDestroy) and was flagged by 9 out of 95 security vendors on VirusTotal, reinforcing its classification as a phishing threat. The domain's creation date, recent detection by security vendors, and current offline status suggest it may have been part of a short-lived campaign or is undergoing remediation. Defenders should treat this domain as high-risk for VPN-related phishing.

While the site is offline, monitoring for re-activation or related infrastructure (e.g., subdomains, linked IPs, or newly registered lookalike domains) is recommended. Blocking the domain and its resolved IP at the network level can mitigate residual risk. Further investigation into the SSL certificate's usage across other domains and the hosting provider's history may uncover additional malicious activity.