yandexhelp[.]info

Analysis of yandexhelp.info, observed on July 24, 2026, indicates that the domain was registered on November 16, 2025 through Web Commerce Communications Limited and is hosted on the IPv4 address 94.103.1.58, which belongs to AS209207 Digital Hosting Provider LLC located in the Netherlands. The domain resolves to a server presenting a Google Trust Services / WR2 TLS certificate, and the authoritative name servers are ns-cloud-d1.googledomains.com through ns-cloud-d3.googledomains.com, confirming use of Google Cloud DNS infrastructure. An HTTP request to the root URL returns status code 204, and the page title reported by the scanner is “Яндекс.Доставка — безопасная доставка”, referencing the Yandex Delivery brand.

VirusTotal records show that 4 of 95 scanned security vendors flagged the domain as malicious, and the domain appears on a single public blocklist, PhishDestroy. The domain is currently taken offline, but the combination of a brand‑specific title, a valid SSL certificate, and detection by multiple vendors suggests a credential‑harvesting campaign targeting Yandex users. No additional payload or content analysis is available, leaving the exact phishing workflow uncertain.

Defenders should continue to block the IP 94.103.1.58, add yandexhelp.info to internal deny lists, monitor for re‑registration, and consider extending detection rules to include similar Google‑hosted domains that serve Yandex‑related titles. Ongoing observation of the registrar and hosting provider may reveal further reuse of the infrastructure in future campaigns.