vk-auth-id[.]com

The domain vk-auth-id.com is identified as a credential theft operation specifically targeting users of the Vkontakte social media platform. Analysis confirms the domain is designed to harvest login credentials by impersonating the authentic Vkontakte authentication portal. As of the latest assessment, the domain is currently offline, though prior activity and infrastructure indicators remain relevant for threat detection and mitigation efforts. Infrastructure analysis reveals multiple high-confidence threat indicators associated with vk-auth-id.com. The domain was flagged by 12 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It was created on March 05, 2026, under an undisclosed registrar, and resolves to the IP address 38.180.245.67. The domain appears on one security blocklist, and its SSL certificate is registered to vkauthtoid.com, a related or aliased domain likely used to reinforce the impersonation scheme. AlienVault OTX records show the domain in 21 distinct threat intelligence pulses, further corroborating its malicious classification. Current status indicates vk-auth-id.com has been taken offline, though the underlying infrastructure may remain active or be repurposed for future attacks. Organizations and users are advised to block the domain and its associated IP address at the network perimeter. Endpoint protection systems should be updated to include the domain and SSL certificate as indicators of compromise. Users who may have interacted with the site should immediately reset their Vkontakte credentials and enable multi-factor authentication. Security teams are encouraged to monitor for any resurgence of this domain or similar impersonation attempts targeting social media platforms.