resolvmainnet[.]xyz

The domain resolvmainnet.xyz is identified as a phishing site targeting users of official Russian government services. Analysis indicates this domain impersonates the legitimate Портал государственных услуг Российской Федерации (Public Services Portal of the Russian Federation) with the intent to harvest credentials or distribute malicious payloads. As of the latest assessment, the domain is offline, though its infrastructure remains a documented threat. Infrastructure analysis reveals the domain was registered through NameSilo, LLC on June 18, 2025, and resolves to the IP address 45.150.34.122. Detection metrics show 4 of 95 security vendors on VirusTotal flagged this domain as malicious, while it appears on three independent security blocklists. The SSL certificate is issued by Let’s Encrypt, a common tactic to lend superficial legitimacy. Additional indicators include a Gridinsoft trust score of 0/100 and active blocking by MetaMask, SEAL, and PhishDestroy. Current status confirms the domain has been taken offline, though residual risk persists due to its recent creation and documented phishing activity. Users are advised to verify all government service portals via official channels only, avoid clicking links from unsolicited communications, and monitor accounts for unauthorized access. Security teams should update blocklists to include this domain and its associated IP address, while reviewing logs for prior connections to 45.150.34.122.