verificationbot[.]club

This domain, verificationbot.club, operates as a fake bot verification scam designed to harvest user credentials or deploy malicious payloads under the guise of automated validation. The site mimics legitimate bot verification processes, tricking users into entering sensitive information such as login credentials, session tokens, or personal data. Analysis indicates the site may also distribute malware or redirect victims to secondary phishing pages, amplifying the risk of account compromise or financial loss. The deceptive design and branding align with common social engineering tactics, targeting users who interact with automated systems or chatbots. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Global Domain Group LLC, an uncommon registrar for legitimate services. It resolves to IP address 104.21.5.39, hosted on Cloudflare’s network (AS13335), which is frequently abused by threat actors to obscure malicious infrastructure. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites often leverage valid certificates to appear legitimate. VirusTotal detections show 21 out of 95 security vendors flag the domain as malicious, with classifications including phishing, fraud, and potentially unwanted programs. The domain appears on one security blocklist and is actively blocked by enterprise security tools. Users who visited verificationbot.club should immediately terminate any active sessions and avoid entering credentials or downloading files. If login details were submitted, reset passwords for all associated accounts, particularly those linked to financial services or email providers. Enable multi-factor authentication where available to mitigate unauthorized access. Scan the device for malware using updated security software, focusing on browser extensions or downloaded executables. Monitor accounts for suspicious activity, such as unauthorized transactions or password reset emails. Report the incident to relevant security teams or fraud departments, providing the domain, IP address (104.21.5.39), and any collected indicators of compromise. Avoid re-engaging with the domain or related links, as the infrastructure may persist even after initial takedown attempts.