dragoncc[.]ru

The domain dragoncc.ru is a phishing site engaged in brand impersonation, specifically targeting users of the cryptocurrency platform 'across'. This site was designed to deceive victims into believing they were interacting with a legitimate financial service, potentially leading to unauthorized access to cryptocurrency wallets or credentials. As of the latest verification, dragoncc.ru has been taken offline, but it previously operated as a cryptocurrency scam without an associated drainer kit.

Technical indicators confirm the malicious nature of dragoncc.ru. The domain was flagged by 1 of 95 VirusTotal security vendors, including SOCRadar, and appeared on 1 security blocklist (PhishDestroy). Registered through RU-CENTER-RU on August 24, 2024, it resolved to the IP address 104.225.221.210, hosted in the US under AS29802 (HIVELOCITY, Inc.). The SSL certificate was issued by Let's Encrypt (R12), and the observed page title was 'DragonCC : Financial Services'. Technologies detected on the site included Bootstrap, LiteSpeed, Slick, jQuery, Google Hosted Libraries, Google Analytics, and HTTP/3. Nameservers were dns1.cornq.com and dns2.cornq.com.

Individuals who interacted with dragoncc.ru should take immediate action to secure their assets and accounts. For cryptocurrency users, revoke any token approvals granted to the site and transfer funds to a new wallet. If login credentials were entered, change passwords immediately, enable two-factor authentication (2FA), and monitor accounts for unauthorized activity. Report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand's security team to aid in takedown efforts.