vrsecure-go[.]plus

Analysis of the domain vrsecure-go.plus indicates it is an active credential phishing site, operational as of July 19, 2026. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and remains active despite being flagged by 4 of 91 security vendors on VirusTotal and appearing on one security blocklist, PhishDestroy. Infrastructure analysis reveals the domain resolves to the IP address 172.67.219.8, hosted on Cloudflare’s network in Canada, with nameservers daisy.ns.cloudflare.com and yahir.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious sites leveraging Cloudflare’s infrastructure. The HTTP status code 403 and page title 'Just a moment...' suggest the site may be employing Cloudflare’s anti-bot protections or interstitial pages to evade automated detection while filtering potential victims. This behavior is consistent with phishing campaigns that use Cloudflare to obscure backend infrastructure and mitigate takedown efforts. While the exact brand or service being impersonated is not yet confirmed, the domain’s classification as a credential phishing site is supported by its presence on PhishDestroy’s blocklist and the detection count on VirusTotal. Defenders should treat this domain as high-risk and implement blocking at the DNS or network level. Given its reliance on Cloudflare, monitoring for changes in IP resolution or nameserver assignments may provide additional indicators of compromise. Further analysis of the site’s content, if accessible, could reveal targeted brands or specific phishing kits in use. Until then, the domain should be considered malicious and handled with appropriate caution.