xn--90aavapgipqq5hpb[.]robbiewilliamsmusic[.]ru

Analysis of xn--90aavapgipqq5hpb.robbiewilliamsmusic.ru shows a high‑risk, active generic phishing infrastructure. The domain, registered on November 17, 2010 through RU-CENTER-RU, resolves to IP 185.64.76.68, which is owned by AS208626 ServTech LTD in Russia. HTTP requests receive a 302 redirect, and the only observed page title is "Аккаунт заблокирован". The site runs on PHP behind an Apache HTTP Server and presents a valid Let's Encrypt certificate (R13).

Reputation data reinforces the malicious assessment: the domain appears on two security blocklists (PhishDestroy and PhishingDB) and is flagged by Google Safe Browsing for SOCIAL_ENGINEERING. VirusTotal scans report 14 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0 out of 100. These signals collectively indicate that the domain is being used for phishing campaigns targeting Russian‑speaking users.

The observable evidence does not disclose the specific phishing kit, payload, or targeted brand beyond the generic page title. No additional content analysis is available, leaving the exact lure and credential‑harvesting mechanisms uncertain. However, the combination of blocklist presence, multiple vendor detections, and a low trust score suggests a deliberate attempt to deceive visitors and capture sensitive information.

Defenders should treat xn--90aavapgipqq5hpb.robbiewilliamsmusic.ru as hostile. Immediate actions include adding the domain and its resolving IP (185.64.76.68) to web‑filter blocklists, updating DNS sinkhole configurations to intercept queries, and monitoring network traffic for outbound connections to the IP. Continuous threat‑intel feeds should be consulted for any emerging indicators related to this infrastructure, and incident response teams should be prepared to investigate any credential compromises that may be linked to this domain.