vyroget152[.]to

PhishDestroy identifies vyroget152.to as an active credential-theft endpoint designed to harvest user login details under the guise of a legitimate service. The domain resolves to IP 66.198.225.40 and is currently serving a live phishing page that mimics a login portal, tricking visitors into entering their credentials. Security telemetry confirms this is a targeted attack against unsuspecting users, not a mass spam campaign, making it particularly dangerous due to its selective and deceptive nature. This domain was flagged with a high-risk profile: VirusTotal shows zero detections out of 95 engines, indicating it is currently under the radar of mainstream security tools. The domain was registered through Gname.com Pte. Ltd. on March 13, 2026, and is already listed on one security blocklist—specifically blocked by OISD. The presence of a Let's Encrypt SSL certificate further enhances its credibility, masking malicious intent behind standard web encryption practices. These technical indicators suggest an emerging threat that is actively evading detection while preparing to harvest sensitive user data. If you have visited vyroget152.to, immediately change any passwords entered on the site and enable multi-factor authentication on all affected accounts. Scan your device with updated antivirus software to detect any residual malware or credential-stealing scripts. Report the domain to your IT security team or via PhishDestroy’s portal to contribute to collective threat intelligence. Avoid re-engaging with this domain, as it remains active and poses an ongoing credential theft risk. Stay vigilant and verify URLs through trusted sources before entering any login details.