log6[.]vkauth-id[.]com

The domain log6.vkauth-id.com is identified as a credential theft operation specifically targeting users of the VK social media platform. Analysis confirms the domain is designed to harvest login credentials by impersonating the official VK authentication portal. As of the latest verification, the domain has been taken offline, though prior activity remains a documented threat. Technical indicators reveal multiple red flags associated with this domain. It was registered through HOSTINGER operations, UAB, on March 07, 2026, and resolves to the IP address 72.60.191.83, hosted under AS47583 (Hostinger International Limited) in France. The domain appears on one security blocklist and is flagged by 13 of 95 security vendors on VirusTotal. Notably, the page title displayed to users is 'Вход ВКонтакте,' directly mimicking the legitimate VK login page. The absence of an SSL certificate further undermines any pretense of legitimacy, as secure connections are a baseline expectation for authentication portals. Infrastructure analysis indicates this domain was part of a broader credential harvesting campaign, likely targeting Russian-speaking users given the language and platform impersonated. While the domain is currently offline, organizations and individuals should remain vigilant for similar impersonation attempts. Recommended actions include blocking the domain and its associated IP (72.60.191.83) at the network level, updating endpoint protection rules to detect credential theft attempts, and educating users on verifying domain authenticity before entering login details. Monitoring for newly registered domains with similar naming patterns (e.g., 'vkauth' or 'vkontakte') is advised to preemptively mitigate emerging threats.