magic-rust[.]ru

This domain, magic-rust.ru, is currently flagged as a high-risk generic phishing site. The domain has been active since its creation on May 21, 2026, and is currently resolving to the IP address 185.97.254.134, which is located in Russia and hosted by ARTPLANET PEER SPB ADDOS # 1. The site has an HTTP status of 307, indicating a temporary redirect, which could be a technique used to evade detection or to redirect users to a different malicious site. The domain appears on one security blocklist and is blocked by PhishDestroy, a security service, suggesting that it has been identified as potentially harmful. Additionally, the SSL certificate for magic-rust.ru is issued by Let's Encrypt, which is a common choice for legitimate and malicious sites alike, and does not inherently indicate trustworthiness. The domain's MX records point to mx.yandex.net, indicating that it may be using Yandex for email services, which could be used to facilitate further phishing activities or for other malicious purposes. The Gridinsoft trust score for this domain is 0 out of 100, which is a strong indicator of its untrustworthiness. VirusTotal reports that 2 out of 95 security vendors have flagged this domain, and it has been mentioned in one threat intelligence pulse on AlienVault OTX. While the low number of security vendor flags might suggest some uncertainty, the combination of the domain's appearance on a security blocklist, its low trust score, and its active status strongly indicate that it is being used for phishing. Defenders should exercise extreme caution when encountering this domain and should consider blocking it at the network level to prevent any potential phishing attacks. Further investigation into the domain's activities and the nature of the content it redirects to would provide additional insights and help in making a more comprehensive assessment of the threat.