resolvprotocol[.]xyz

This domain, resolvprotocol.xyz, is flagged as an active phishing site targeting users of Russian government services. Analysis indicates the domain was registered on June 18, 2025, through NameSilo, LLC, and currently resolves to the IP address 45.150.34.122, hosted under AS205775 (NEON CORE NETWORK LLC) in the Netherlands. The page title, extracted from the site, is "Портал государственных услуг Российской Федерации," which directly translates to "Portal of Public Services of the Russian Federation," suggesting an attempt to impersonate an official government portal. The domain is classified as a crypto scam in available threat intelligence, though further details on the specific mechanics of the scam are not provided in the current data. Infrastructure analysis reveals the use of nameservers ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com, a configuration commonly observed in phishing operations due to its low-cost and flexible management. The domain is secured with a Let's Encrypt SSL certificate (identifier YE2), which is typical for both legitimate and malicious sites, as it provides encryption without validation of the site's legitimacy. The HTTP status code 200 confirms the site is currently accessible, and it remains unblocked by most security vendors, with only 3 out of 93 flagging it as malicious on VirusTotal. The domain appears on one security blocklist and has a trust score of 0/100, reinforcing its high-risk classification. Defenders should prioritize blocking this domain at the DNS and network level, particularly in environments where access to Russian government services is relevant. The use of a non-Russian hosting provider (AS205775 in the Netherlands) is consistent with phishing campaigns seeking to evade regional takedown efforts. While the exact content of the site has not been analyzed, the combination of the page title, domain registration details, and hosting infrastructure provides sufficient evidence to classify resolvprotocol.