vorlbicks[.]com

This domain, vorlbicks.com, is currently flagged as an active credential-phishing endpoint based on infrastructure analysis and detection telemetry. Registered on February 21, 2026, through Dynadot LLC, the domain resolves to the IP address 213.209.129.79, which is geolocated in Romania and associated with autonomous system AS208185 operated by Net Gate Telecom S.R.L. The domain's nameservers, ns1.dyna-ns.net and ns2.dyna-ns.net, remain consistent with the registrar's infrastructure, though this alone does not distinguish legitimate from malicious use. Analysis indicates the site is operational, returning an HTTP 200 status code with a page title matching the domain itself, a pattern often observed in phishing pages designed to mimic legitimate login portals. While the domain holds a Gridinsoft trust score of 0 out of 100, this metric reflects a lack of established reputation rather than direct evidence of compromise. More notably, three out of ninety-five security vendors on VirusTotal have flagged the domain as malicious, and it appears on at least one security blocklist. The SSL certificate, issued by Let's Encrypt under the YR1 chain, provides encryption but does not validate the site's legitimacy, as phishing campaigns routinely leverage free certificates to appear secure. The registration timeline and hosting provider are consistent with patterns observed in short-lived phishing domains, though no definitive link to a known phishing kit or brand impersonation has been confirmed. Defenders should treat this domain as high-risk, particularly in environments where credential harvesting poses a critical threat. Network-level blocking of 213.209.129.79 and monitoring for connections to vorlbicks.com are recommended until the domain is confirmed inactive or remediated. Given the limited but consistent detection signals, further investigation into associated infrastructure, such as co-hosted domains or recent DNS changes, may reveal additional compromised assets.