vcode-cloud-demo[.]karambasecurity[.]io

This domain, vcode-cloud-demo.karambasecurity.io, is currently active and classified as a high‑risk generic phishing campaign. The site returns HTTP 200 and presents the page title “VCode • Login”, indicating an attempt to collect login credentials. Infrastructure analysis shows the domain is hosted on Amazon AWS (AS14618) at IP 44.199.198.135, which resolves to a server running Nginx and protected by Google reCAPTCHA. The domain is delegated to Cloudflare name servers aragorn.ns.cloudflare.com and gina.ns.cloudflare.com and uses a Let’s Encrypt R12 certificate, confirming TLS encryption is in place. Registration data reveals the domain was created on 7 July 2021 through GoDaddy.com, LLC, and the SSL certificate is valid, suggesting a legitimate registration process rather than a fast‑flux setup. Threat intelligence indicates five of ninety‑five VirusTotal scanners flagged the domain, and it appears on at least one security blocklist. PhishDestroy has already blocked the domain, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. While the page content beyond the title has not been examined, the observable indicators—high‑risk classification, credential‑stealing page title, active status, and multiple security detections—justify immediate defensive action. Organizations should add the domain and its resolved IP to DNS and firewall blocklists, monitor for related traffic, and consider sinkholing the IP range to disrupt further credential harvesting. Continuous re‑evaluation is advised in case the infrastructure evolves.