fakebill[.]vps6s[.]com

This domain, fakebill.vps6s.com, is currently active and flagged as a high-risk generic phishing threat. It was registered on December 20, 2024, through GMO Internet, Inc., and resolves to IP address 172.67.193.158, which is hosted by Cloudflare, Inc. in the United States. The domain uses Cloudflare nameservers (chase.ns.cloudflare.com and lily.ns.cloudflare.com) and has no SSL certificate, which is unusual for legitimate financial services. The page title, "Hệ thống fakebill - chuyển khoản ngân hàng," indicates the site is a Vietnamese-language fake bill payment system for bank transfers, suggesting it is designed to deceive users into sending money or credentials. VirusTotal data shows 1 out of 95 security vendors flagged the domain, and it appears on one security blocklist (PhishDestroy). The Gridinsoft trust score is 0/100, reflecting high suspicion. The HTTP status is 200, meaning the site is accessible. What remains uncertain is the exact method of phishing delivery—whether via email, SMS, or social engineering—and the specific banking brands targeted. Defenders should block this domain at the DNS and email gateway levels, monitor for related subdomains or IPs, and warn users about unsolicited payment requests. Given the active status and lack of SSL, any interaction with this domain poses a significant risk of credential theft or financial fraud.