verificationscodes[.]beer

Analysis of verificationscodes.beer shows a high‑risk, active phishing infrastructure. The domain presents a 403 Forbidden page title and serves an SSL certificate issued by Let’s Encrypt (YR1), indicating HTTPS is enabled but not revealing site content. DNS resolution points to IP 178.16.52.101, which GeoIP maps to Germany and is listed as owned by Omegatech LTD. The domain is hosted on Cloudflare, using the nameservers samara.ns.cloudflare.com and kareem.ns.cloudflare.com, a pattern common among malicious actors seeking traffic obfuscation. Reputation data is strong: 22 of 91 VirusTotal scanners flag the domain, AlienVault OTX lists it in nine threat‑intel pulses, and it appears on three external blocklists. Additionally, it is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming its recognition as a phishing vector. Registration was performed through Dynadot Inc, but no further registrant details are disclosed. The current observable evidence does not include the actual malicious payload or targeted brand, leaving the precise phishing lure uncertain. Defenders should block the domain and its associated IP at network perimeters, monitor DNS queries for the Cloudflare nameservers, and continue threat‑intel correlation for any emerging indicators tied to the host. Ongoing surveillance is advised to capture any future content changes or additional infrastructure that may clarify the phishing campaign’s objectives.