vzgrab[.]com

vzgrab.com is an active domain identified in social engineering phishing operations as of July 26, 2026. The domain was registered on July 22, 2026, via NICENIC INTERNATIONAL GROUP CO., LIMITED, indicating recent establishment. It currently resolves to IP address 188.114.97.3 and uses Cloudflare nameservers (dorthy.ns.cloudflare.com and kipp.ns.cloudflare.com), suggesting the use of a proxy or CDN service to obscure backend infrastructure and potentially impede takedown efforts.

Google Safe Browsing has flagged this domain for social engineering, providing concrete evidence that it is being used to deceive or manipulate users, typically associated with phishing attempts. Additionally, vzgrab.com appears on at least one security blocklist and has been blocked by PhishDestroy, further substantiating its association with malicious activity. While a VirusTotal scan shows no current detections from 91 vendors, this absence should not be interpreted as an indicator of safety, especially given the corroborating blocklist and Safe Browsing evidence.

There is no information available regarding the specific content, targeted brands, or scam kit in use. The page title and exact web content have not yet been analyzed, so the precise nature of the phishing attempt remains undetermined. Defenders should note that the domain remains operational and poses a high risk due to its recent creation, active status, and multiple independent security flags. Immediate blocking at network and endpoint levels is recommended, and further monitoring for related domains registered through the same registrar or utilizing similar infrastructure is advised.