vgsgu2[.]top

This domain, vgsgu2.top, is confirmed to host a credential harvesting phishing operation targeting users through deceptive login interfaces. Analysis indicates the site mimics legitimate authentication portals to capture sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. The threat is categorized as high-risk due to its active status and direct impact on user security, with potential for immediate account compromise and subsequent unauthorized access to linked services. Infrastructure analysis reveals the domain was registered on April 11, 2026, through the registrar Cosmotown, a provider frequently associated with malicious registrations. As of the latest scan, 24 out of 95 security vendors on VirusTotal flag vgsgu2.top as malicious, with detections ranging from phishing to generic malware distribution. The domain appears on one security blocklist and is actively blocked by enterprise-grade filtering systems. Google Safe Browsing has also issued a phishing alert, further validating the threat classification. Users who have visited vgsgu2.top or entered credentials on the site should immediately revoke access to any accounts that may have been exposed. Passwords for all associated services must be reset using a secure, non-compromised device. Multi-factor authentication should be enabled where available, and users are advised to monitor accounts for unauthorized activity, including logins from unfamiliar locations or devices. Network administrators should update blocklists to include vgsgu2.top and its associated IP addresses to prevent further access within corporate or institutional environments.