vurakoin[.]com

Analysis of the domain vurakoin.com shows a newly created site (registered March 12, 2026) that presents itself as a CFD trading service, as indicated by the page title "Vurakoin | CFD Trading — Trading on Stocks, Gold, Oil, Indices." The site is protected by a Let’s Encrypt R12 certificate and resolves to IP 163.61.188.5, which geolocates to the United States and is associated with the MIT network. The domain is hosted on Lytehosting name servers (dns1.lytehosting.com through dns4.lytehosting.) and serves content over HTTP with a 200 response code, confirming that the site is currently active. Reputation services assign extremely low trust scores (Gridinsoft 1/100, Scamadviser 1/100) and VirusTotal reports 16 of 91 scanners flagging the domain, indicating malicious activity. It appears on at least one security blocklist and is already blocked by PhishDestroy, reinforcing the high‑risk classification. Detected technologies include YouTube embeds, Tailwind CSS, LiteSpeed web server, Alpine.js, Unpkg, Smartsupp chat widget, and both jQuery CDN and core jQuery libraries, which are commonly used in fraudulent pages to add functionality and tracking. While the exact content of the landing page has not been captured, the combination of brand impersonation labeling, low trust scores, multiple security vendor detections, and active hosting strongly suggests a phishing operation targeting individuals interested in financial trading. Defenders should immediately block vurakoin.com at DNS and proxy layers, add its IP address to network deny lists, monitor for outbound connections to the listed services, and incorporate the observed technology fingerprints into detection rules. Ongoing surveillance of the domain’s infrastructure and any associated subdomains is recommended to detect potential expansion of the campaign.