The .vu Surge: How Threat Actors Are Exploiting Vanuatu's Domain Extension
KnowBe4, Friday, August 28th, 2026
KnowBe4 Threat Lab reports a 159% surge in phishing exploiting Vanuatu's .vu top-level domain.
KnowBe4 Threat Lab, with lead analysts Prabhakaran Ravichandhiran and Jeewan Singh Jalal, reports a 159% surge in phishing attacks using Vanuatu's .vu domain extension.
The research frames phishing infrastructure as intentionally disposable: when a domain gets blocklisted, scrutinized or simply too hot to keep using, attackers do not stop, they move.
To them a domain extension is a cheap tool, chosen for availability and low friction rather than any connection to the country it represents. The post examines why .vu has become attractive and what defenders should watch for.