verify[.]wickbot[.]net

Analysis on July 24, 2026 identifies verify.wickbot.net as a credential‑phishing infrastructure that has been taken offline. The domain was registered on February 21, 2026 and the only visible content is the page title “verify.wickbot.net”. VirusTotal records show that one of ninety‑five scanning engines flagged the domain, indicating at least a single detection of malicious behavior. The site is listed on the PhishDestroy blocklist and appears on a single security blocklist overall. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, reinforcing the malicious assessment.

The scam type is explicitly classified as Credential Phishing in the intelligence feed. No additional infrastructure details such as hosting IP, autonomous system number, geographic location, SSL certificate status, or Safe Browsing verdict are available in the current dataset. Consequently, the broader attack surface, including any command‑and‑control servers or associated domains, cannot be confirmed at this time. The lack of public evidence beyond the blocklist entries and the single vendor flag suggests that the operation may have been short‑lived or limited in scope, but the presence of a dedicated blocklist entry indicates that at least one security community has observed malicious activity related to the domain. Defenders should continue to monitor for any resurgence of the domain or related indicators.

Recommended actions include adding verify.wickbot.net to internal blocklists, ensuring that email security gateways reject messages containing URLs or links to this domain, and updating intrusion detection signatures to flag any outbound connections to the domain’s IP address should it become resolvable. Because the domain is currently offline, active scanning is unlikely to yield further payloads, but retrospective log analysis may uncover prior attempts to deliver credential‑stealing pages.