poroshok[.]icu

The domain poroshok.icu was observed on 12 July 2026 and is currently classified as a high‑risk generic phishing host. The site returns HTTP 200 and presents a Russian‑language storefront titled “Магазин ядов для людей – купить сильные яды”, which is consistent with credential‑stealing lure techniques. Infrastructure analysis shows the domain was registered on 15 May 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. Authoritative name servers are brian.ns.cloudflare.com and rachel.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. The domain resolves to 188.137.252.97, an address assigned to NL‑based Podaon SIA. TLS is provided by a Let’s Encrypt certificate (E7). Threat‑intel sources corroborate the malicious nature of the host. AlienVault OTX includes the domain in one pulse, and VirusTotal records two of ninety‑five scanners flagging it as malicious. The domain appears on a single security blocklist and is blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment. While the current evidence confirms the domain’s phishing purpose, the limited number of vendor detections and the single blocklist entry leave a degree of uncertainty regarding the full extent of its distribution. No additional payload hashes, command‑and‑control infrastructure, or victim reports have been publicly disclosed, so the campaign’s scale remains unclear. Defenders should proactively deny network connections to poroshok.icu and its resolved IP address 188.137.252.97. Email security gateways ought to include the domain in block lists, and DNS filtering solutions should redirect queries to a sinkhole. Continuous monitoring of Cloudflare name‑server activity and periodic re‑scans on VirusTotal are recommended to capture any evolution of the threat.