vintagevista[.]xyz

Analysis of vintagevista.xyz shows a recent registration (27 August 2025) through NameSilo, LLC. The domain resolves to IP 134.122.177.8, which is hosted in Hong Kong and belongs to AS152194 (CTG Server Limited). DNS is served by Cloudflare nameservers aliza.ns.cloudflare.com and jim.ns.cloudflare.com, and no TLS certificate is presented, indicating traffic is served over plain HTTP. The public page title returned from the site is “TK-Store | buy, sell and discover on TK”, which does not match the claimed brand target. Intelligence flags the domain as a brand‑impersonation campaign aimed at the brand “across”.

Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that 14 of 95 antivirus and URL scanners flag the domain as malicious. The domain is listed on one external security blocklist and is actively blocked by PhishDestroy. AlienVault OTX references the domain in 17 separate threat‑intel pulses, reinforcing its association with malicious activity. The site’s current operational status is offline, suggesting that the malicious infrastructure has been taken down or is no longer serving content.

While the observed indicators confirm that vintagevista.xyz has been used for brand‑impersonation and is recognized by multiple security vendors, the exact payload or phishing kit deployed on the site cannot be verified because the HTTP service is no longer reachable. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor for any resurgence of the IP address or associated ASN, and add the domain to internal deny lists. Incident response teams should also review any recent logs for connections to 134.122.177.8 or DNS queries for vintagevista.xyz, as remnants of the campaign may still be present in compromised systems. Ongoing threat‑intel feeds should be consulted for updates, particularly any new associations with the “across” brand or changes to the hosting infrastructure.