varrwghda[.]com

Analysis of the domain varrwghda.com indicates it is an active phishing infrastructure under investigation as of July 21, 2026. The domain was registered on July 19, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently observed in phishing campaigns. It currently resolves to the IP address 85.239.144.149, which has not yet been widely flagged in public threat intelligence feeds. The domain utilizes Cloudflare nameservers (elly.ns.cloudflare.com and micah.ns.cloudflare.com), a configuration commonly employed to obscure hosting details and evade detection. As of the latest scan, 95 security vendors on VirusTotal have evaluated the domain, with none currently detecting it as malicious.

However, the absence of detections does not confirm safety, as phishing domains often evade initial scans before being flagged. The domain appears on one security blocklist, suggesting preliminary suspicion, though the specific nature of the phishing activity remains unconfirmed. No brand impersonation, scam type, or page content has been verified at this stage, and the exact threat vector is undetermined. Defenders are advised to monitor this domain closely, particularly given its recent registration and use of Cloudflare for DNS resolution.

Network-level blocking may be warranted if additional indicators of compromise emerge. Organizations should correlate this domain with internal logs to identify potential exposure or compromise. Further analysis is required to determine the targeted brand, phishing kit, or campaign affiliation. The domain remains active, and updates to detection rules are expected as more intelligence becomes available.