vvvchecker[.]com

PhishDestroy has identified vvvchecker.com as a dangerous phishing site that tries to steal your X (formerly Twitter) login credentials. The page title reads exactly like the official X login page: “X. It’s what’s happening / X,” tricking visitors into thinking they are on the legitimate platform. This is a classic credential harvesting attack, and anyone who enters their username and password on this site risks having their account compromised.

Our investigation uncovered several red flags. VirusTotal shows that 3 out of 95 security vendors flagged this domain as malicious, while the site itself is protected by a Let’s Encrypt SSL certificate (E7), which ironically gives it a false sense of security. The domain was registered on April 14, 2026, through Realtime Register B.V., and resolves to IP address 104.21.13.109. Currently, the site has been taken offline, but similar clones can reappear. It already appears on three security blocklists, confirming its malicious intent.

If you visited vvvchecker.com and entered your X credentials, change your password immediately and enable two-factor authentication. Also revoke any app permissions you may have granted. Even though the site is offline now, your data may have been captured. Stay alert for suspicious login attempts and consider using a password manager to avoid reusing passwords across sites.