vmtool[.]net

The domain vmtool.net was registered on June 3, 2026 and is currently active. HTTP requests return a 403 status and the page title is "Bot Verification," indicating a challenge page rather than a public site. The domain resolves to IP address 104.21.12.88, which is owned by a large content delivery network located in Canada. TLS is provided by a certificate issued by Google Trust Services under the WE1 trust framework. Infrastructure analysis shows the use of HTTP/3 and a captcha mechanism, suggesting an attempt to filter automated traffic. Reputation data is poor: the domain appears on three security blocklists, has a trust score of 23 out of 100, and five of ninety‑one antivirus vendors on VirusTotal flag it as malicious. It is blocked by multiple phishing mitigation tools. No additional payload or phishing page content has been observed, so the exact lure or credential‑stealing technique remains unknown. Defenders should immediately block vmtool.net at perimeter firewalls, proxy filters, and endpoint web controls, and add the associated IP to deny lists. Continuous monitoring for any changes in HTTP response codes or content is advised, as the site may evolve to deliver phishing content after the initial verification stage.