vtuetopop[.]com[.]ng

vtuetopop.com.ng is currently classified as a high‑risk generic phishing site. The domain was registered on 21 February 2026 and resolves to the IPv4 address 157.173.103.205, which is hosted in France under AS51167 (Contabo GmbH). The domain is active as of 12 July 2026 and returns HTTP 200 for the root path, with the page title reported as "Index of /". The SSL certificate presented is identified as R12, and the authoritative nameservers are ns1.mygotodns.com and ns2.mygotodns.com. Registration was performed through TRUEHOST CLOUD.

Infrastructure analysis shows a Gridinsoft trust score of 0 out of 100, indicating an extremely low reputation. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal reports that 1 out of 95 scanned security vendors flagged the domain, providing a minimal but concrete indication of malicious behavior. No additional public intelligence, such as associated phishing kits or targeted brands, is available beyond the generic phishing classification.

The combination of a recent creation date, low trust score, active HTTP service, and the presence on a dedicated phishing blocklist suggests that the domain is being used for malicious credential harvesting or similar activities. The limited detection by VirusTotal may reflect a short observation window, but the existing indicators are sufficient for a high‑confidence assessment of risk.

Defenders should add vtuetopop.com.ng to inbound and outbound filtering rules, enforce DNS‑based blocking, and monitor for any DNS queries to the associated nameservers. Network traffic to 157.173.103.205 should be logged and, where possible, redirected to a sinkhole. Continuous re‑evaluation is recommended, as future scans may increase the detection count and reveal additional malicious payloads.