tg-change-verify[.]ru

This domain is flagged as a high-risk credential phishing threat. Analysis of available intelligence shows the domain tg-change-verify.ru was created on May 24, 2026, and remains active as of July 12, 2026. It resolves to IP address 87.120.107.209, which is located in Finland and associated with the hosting provider Mykyta Skorobohatko. The server runs Ubuntu with Nginx and supports HTTP/3. The SSL certificate is issued by Let's Encrypt (serial E8). The page title is 'Loading', indicating the site may load dynamic content or redirect after initial connection. The Gridinsoft trust score is 0 out of 100, and the domain appears on three security blocklists. VirusTotal detection shows 8 out of 91 security vendors flag the domain as malicious. It is blocked by PhishDestroy, MetaMask, and SEAL. The exact visual content of the site has not been analysed, but the scam type is explicitly credential phishing, suggesting the page is designed to harvest login credentials. Defenders should block this domain at the DNS and email gateway levels, monitor for any associated subdomains or IP changes, and educate users not to interact with unsolicited messages referencing this domain. As the domain is still active, continued monitoring is advised.