vinted[.]id864349[.]click

PhishDestroy identifies vinted.id864349.click as a live phishing domain using a generic_phishing threat vector, disguised as the legitimate Vinted resale platform. The site employs a fake login interface to harvest user credentials and session tokens, a technique consistent with credential phishing kits detected across similar domains. No advanced drainer kit signatures (e.g., wallet drainers) have been observed in initial scans, but the low detection rate and recent domain registration suggest active deployment of basic but effective social engineering tactics.

This domain was flagged with a 5/95 detection rate on VirusTotal, indicating no current blacklist coverage as of the last scan. It resolves to IP 188.114.96.3, registered on March 30, 2026, through NameSilo, LLC using a Let's Encrypt SSL certificate. As of the latest assessment, it remains unlisted in Google Safe Browsing (GSB) and has not appeared on major threat intelligence blocklists. The domain’s age (just over one week) and pristine reputation score suggest it is either newly weaponized or deliberately under the radar to avoid early detection.

As of this investigation, vinted.id864349.click remains active with no takedown action observed. The site continues to resolve and serve a spoofed login page, posing a direct risk to users attempting to access Vinted services via search or email links. Immediate user action includes avoiding interaction with the domain, clearing cached credentials, and reporting the site to browser vendors and domain registrars. While the current risk is assessed as under_investigation due to low detection coverage, the domain’s rapid deployment and brand impersonation heighten the urgency for proactive blocking and user awareness. Remaining risk depends on the speed of blocklist propagation and potential escalation to higher-tier threats such as wallet drainers.