passports-vip[.]com

This domain, passports-vip.com, is identified as a poison sales scam site targeting Russian-speaking users. The page title, 'Возможно ли купить ЯД для человека в Интернете?' (translated: 'Is it possible to buy poison for humans online?'), explicitly advertises illegal substances, confirming its fraudulent intent. No legitimate brand impersonation or cryptocurrency drainer activity is observed; instead, the domain appears designed to facilitate illicit chemical transactions under the guise of a VIP passport service. The content and structure align with known dark-market scam patterns, where domains masquerade as legal services while promoting prohibited goods. Infrastructure analysis reveals technical indicators consistent with malicious activity. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 185.110.92.47, a host previously linked to other fraudulent schemes. Security vendor detection on VirusTotal stands at 1/95, while AlienVault OTX lists it in one threat intelligence pulse. The domain appears on a single security blocklist, and its SSL certificate, issued by Let's Encrypt (R12), provides no additional trust signals due to the automated and free nature of the certificate authority. No presence is recorded in Google Safe Browsing (GSB) at the time of analysis, though this may reflect the domain's recent takedown rather than benign status. The domain is currently offline, likely due to enforcement actions or voluntary suspension by the registrar. However, residual risk remains elevated due to the domain's recent registration, its association with a known threat actor IP range, and the persistence of its listing in threat intelligence feeds. Users who interacted with the site should assume potential exposure to fraudulent solicitations and monitor for unauthorized transactions or identity misuse. Organizations are advised to block the domain, IP, and associated indicators in perimeter defenses. The creation date discrepancy (2026) suggests possible domain squatting or typo-squatting tactics, emphasizing the need for vigilance against similar schemes targeting niche or high-risk keywords.