virginmoney[.]verifydeviceportal[.]com

This domain, verifydeviceportal.com, is identified as a credential phishing infrastructure designed to impersonate Virgin Money’s Internet Banking portal. Analysis indicates the site specifically targets users by mimicking legitimate device verification or login pages, a common tactic in credential harvesting campaigns. The domain does not appear to be associated with a known drainer kit but exhibits characteristics typical of large-scale phishing operations, including the use of a generic registrar and hosting in a high-risk jurisdiction. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on March 09, 2026, through OwnRegistrar, Inc., an entity frequently associated with low-reputation registrations. It resolves to the IP address 193.24.123.124, located in Russia under AS200593 (PROSPERO OOO), a network segment with a history of hosting phishing and malware distribution sites. VirusTotal reports 21 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The absence of an SSL certificate further undermines its legitimacy, as modern financial services universally enforce encrypted connections. Google Safe Browsing does not currently list the domain, suggesting it may have evaded detection during active operation or was taken down before widespread reporting. As of the latest assessment, verifydeviceportal.com is offline, reducing immediate exposure to end users. However, the domain remains a residual risk due to its recent registration and potential for reactivation. Response actions should include monitoring for DNS reactivation, analyzing historical WHOIS records for linked infrastructure, and correlating the IP address with other known malicious domains. Users who may have interacted with the site are advised to reset credentials for any financial accounts, enable multi-factor authentication, and review transaction histories for unauthorized activity. Organizations should consider preemptive blocking of the domain and its associated IP at the network perimeter to mitigate future threats.