vtrethlp[.]com

This domain, vtrethlp.com, is assessed as a generic phishing site currently offline but previously active on Cloudflare infrastructure. Registered through NAMECHEAP INC on August 21, 2025, the domain resolves to IP 188.114.97.12, part of AS13335 (Cloudflare, Inc.) in the US. Nameservers alberto.ns.cloudflare.com and hazel.ns.cloudflare.com confirm Cloudflare hosting, a common pattern for phishing campaigns due to its low-cost CDN and SSL services. The domain was flagged by PhishDestroy and appears on one security blocklist, with five of 91 security vendors on VirusTotal marking it as malicious.

The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often exploited by threat actors to lend credibility. As of July 24, 2026, the domain returns an HTTP 404 status, indicating it has been taken offline, though defenders should note the infrastructure remains registered and could be reactivated. No specific brand target or phishing kit is identified in available data, and the exact content of the site is not yet analysed.

Defenders are advised to treat this domain as compromised, monitor for DNS reactivation, and review logs for connections to 188.114.97.12 or the domain itself. The use of Cloudflare nameservers and a valid SSL certificate does not mitigate the risk; these are standard tactics to evade basic filtering. Given the domain’s registration age and detection history, it should be blocked at the network level pending further investigation.