enter-virtucls[.]com

Analysis of enter-virtucls.com shows a recently registered domain (created 23 December 2025) that has been taken offline but left a traceable infrastructure. The domain was registered through NiceNIC International Group Co., Limited and delegated to Cloudflare’s authoritative name servers harlan.ns.cloudflare.com and lisa.ns.cloudflare.com. DNS resolution points to IP 104.21.89.237, an address owned by AS13335 Cloudflare, Inc., located in the United States. No TLS certificate is presented for the host, indicating that the site either operated over plain HTTP or was deliberately left without encryption.

Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, suggesting a high likelihood of malicious intent. VirusTotal scans returned three positive detections out of ninety‑three submitted security engines, confirming that at least a subset of reputable scanners identified the domain as malicious. The domain is listed on five external blocklists and is actively blocked by commercial filtering services including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. These independent listings reinforce the assessment that the site was used for phishing, even though the specific brand or page content has not been disclosed.

Because the site is no longer reachable, direct content analysis is unavailable, leaving the exact lure or credential‑harvesting technique uncertain. Defenders should continue to block the domain and its associated IP address at perimeter firewalls, DNS resolvers, and endpoint protection solutions. Monitoring for any re‑registration of the same second‑level domain or for other domains resolving to the same Cloudflare IP is advisable, as threat actors frequently recycle infrastructure. Organizations should also advise users to avoid unsolicited communications that reference the domain, and to verify any login requests through official channels.