vip5[.]com

The domain vip5.com has been identified as a credential-harvesting phishing site targeting financial service users. Analysis indicates the infrastructure was specifically designed to impersonate login portals of major banking institutions, though no single brand name has been conclusively linked to this campaign. The domain is currently offline, though prior activity suggests high-risk credential interception operations. Infrastructure analysis reveals the domain was registered on April 8, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolved to the IP address 172.65.235.97, a host that has been observed in multiple phishing clusters over the past twelve months. Detection metrics show the domain was flagged by 4 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0 out of 100, indicating no legitimate reputation. The domain appears on one security blocklist, specifically PhishDestroy, which tracks active phishing infrastructure. Current status indicates the domain has been taken offline, though residual risk remains due to the transient nature of such campaigns. Organizations are advised to implement DNS-based blocking for the domain and associated IP address. End users should be alerted to verify all financial service login portals through official channels, particularly those accessed via unsolicited links. Network defenders should monitor for connections to 172.65.235.97 and domains registered through Gname.com Pte. Ltd. during the April 2026 timeframe, as these may indicate compromise or targeted phishing attempts.