mezhvencov[.]ru

Analysis of mezhvencov.ru, observed on July 24 2026, indicates that the domain is being used for generic phishing. The domain was registered on September 1 2025 through the Russian registrar REGRU-RU and currently resolves to IP 193.105.134.30, which belongs to ASN 42237 operated by w1n ltd in Sweden. No TLS certificate is presented for the host, meaning HTTP connections are unencrypted. The authoritative name servers are ns1.regerey.com and ns2.regerey.com. The page title returned from the live host before takedown reads “krab1 - профессиональная платформа AT взаимодействия с вендорами”, suggesting the site attempts to masquerade as a professional platform for vendor interaction, though the content has not been captured.

Malware and URL scanning services have reported detections: eight of ninety‑five security vendors on VirusTotal flagged the domain as malicious. Gridinsoft assigned a trust score of zero out of one hundred, indicating that the host is considered highly untrusted. The domain is listed on a single public security blocklist and has been actively blocked by the PhishDestroy service. The current HTTP status is offline, indicating the site has been taken down or is otherwise unavailable at the time of analysis.

Defenders should continue to block any connections to 193.105.134.30 and to the domain mezhvencov.ru at the network perimeter, enforce DNS sinkholing or filtering for the associated name servers, and monitor for any future re‑registration attempts. Because the site lacked TLS, credential capture would have occurred over cleartext HTTP; intrusion detection signatures that look for HTTP POST to this host should be deployed. Additional intelligence gathering, such as request logging of any residual traffic and correlation with other observed phishing campaigns, is recommended to determine whether the infrastructure is part of a larger campaign. Until further evidence emerges, the domain should be treated as high‑risk and remain on blocklists.