onlydotas2[.]hop[.]ru

This domain, onlydotas2.hop.ru, is identified as a brand impersonation threat targeting PlayStation users. Analysis indicates the site presents a fake login interface, as evidenced by the page title "Войти" (Russian for "Login"), designed to harvest credentials from unsuspecting victims. The domain does not appear to deploy a crypto drainer kit but instead focuses on credential theft under the guise of a legitimate gaming platform login portal. The infrastructure and language suggest a targeted approach toward Russian-speaking users, though the impersonation of a global brand expands the potential victim pool. Infrastructure analysis reveals several critical technical indicators. The domain was registered on September 12, 2000, through R01-RU, a registrar commonly associated with malicious domains. It resolves to the IP address 195.16.42.38, located in Russia under AS3216 (PJSC Vimpelcom). Security vendors on VirusTotal flagged the domain at a rate of 17/95, indicating moderate to high confidence in its malicious nature. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and lacks an SSL certificate, further degrading its legitimacy. Google Safe Browsing (GSB) data is not explicitly provided, but the blocklist presence suggests it would likely be flagged there as well. Currently, the domain is offline, reducing immediate risk to end users. However, the elevated risk level persists due to the domain's historical activity and infrastructure. Response actions should include monitoring for reactivation, as threat actors often reuse or repurpose domains for future campaigns. Users who may have interacted with the site are advised to reset credentials immediately, enable multi-factor authentication, and review connected accounts for unauthorized activity. Organizations should ensure this domain and its associated IP are blocked at the network level to prevent accidental access if it resurfaces.