l[.]ventk[.]com

Analysis of l.ventk.com shows a high‑risk phishing infrastructure that has been taken offline as of the report date, July 24 2026. The domain was registered on 18 January 2017 through GANDI SAS and resolves to the IPv4 address 154.82.90.6, which is hosted in Singapore and belongs to AS399077 (Tcloudnet). The authoritative nameservers are ns1.cshen.vip and ns2.cshen.vip, both of which are associated with other malicious payloads observed in recent threat reports. No SSL certificate is presented for the host, and an HTTP request returns a 502 page title, indicating a server‑side error rather than a legitimate service.

Multiple independent threat‑intelligence sources have flagged the domain. PhishDestroy has listed it as blocked, and Google Safe Browsing categorises it under social engineering. VirusTotal scans show that 15 of 95 security vendors have flagged the domain, reinforcing the malicious assessment. The Gridinsoft trust score is 0 out of 100, and the domain appears on at least one external blocklist, confirming its reputation as a hostile resource.

While the site is currently offline and the exact phishing content cannot be examined, the convergence of registrar data, hosting attributes, and vendor detections provides sufficient evidence to label l.ventk.com as a confirmed phishing site. Defenders should add the domain and its resolving IP address to outbound and inbound blocklists, monitor DNS queries for any resurrection attempts, and audit any historical traffic logs for interactions with the host. Continuous watch‑listing of the associated nameservers and ASN is advised, as they may be reused for future campaigns. The absence of a valid TLS certificate and the low trust score further suggest that any future activation of the domain would lack basic security controls, making it a reliable indicator of malicious intent.