m19komrad[.]biz

Analysis of the domain m19komrad.biz, created on 11 Oct 2023 and registered through NiceNIC International Group Co., Limited, shows it was actively used for a generic phishing campaign before being taken offline. The site resolved to IP 91.206.71.248, which belongs to Cloudflare’s network (AS13335) located in the Netherlands. Both authoritative nameservers, david.ns.cloudflare.com and dina.ns.cloudflare.com, point to Cloudflare infrastructure, and the service banner confirms the use of Cloudflare as the sole detected technology. The only visible page element is the title “Вы не робот?” (Russian for “You are not a robot?”), indicating a possible CAPTCHA evasion step, but no further content has been captured.

VirusTotal records indicate that one out of ninety‑three scanned security vendors flagged the domain, and the site is listed on a single external blocklist. PhishDestroy has also added the domain to its sink‑hole, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious classification. The SSL certificate is issued by Google Trust Services under the WE1 profile, which is typical for Cloudflare‑proxied sites and does not mitigate the threat.

Given the offline status, immediate traffic to the domain is unlikely, yet the underlying IP and Cloudflare nameserver range remain active and could be reused for future campaigns. Defenders should continue to block the domain and the associated IP address at perimeter and DNS filtering layers, monitor for any re‑registration or changes in DNS resolution, and consider adding the Cloudflare nameservers to watchlists for anomalous activity. Continuous threat‑intel feeds should be consulted for any resurgence, and incident response teams should be prepared to isolate any internal attempts to contact the domain should it reappear.