severozapadonlineparts[.]ru

This domain, severozapadonlineparts.ru, is identified as a credential theft operation impersonating Instagram, a Meta-owned social media platform. The site presents a fraudulent login interface titled 'Вход • Instagram' to deceive users into submitting their account credentials. Such impersonation schemes are designed to harvest sensitive information, which may lead to unauthorized account access, identity theft, or further exploitation through social engineering tactics. The risk is classified as elevated due to the domain's active targeting of high-value personal data and its association with known malicious infrastructure. Analysis indicates the domain was registered on November 30, 2023, through the registrar REGRU-RU, a provider frequently observed in malicious campaigns. Infrastructure analysis reveals the domain resolves to the IP address 193.151.108.94, hosted under AS207957 (SERV.HOST GROUP LTD) in Germany. Detection metrics show 21 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on two additional security blocklists. The absence of an SSL certificate further undermines the site's legitimacy, as modern secure connections are a baseline expectation for authentic platforms. Users who visited severozapadonlineparts.ru or entered credentials on the site should immediately take corrective action. First, change the password for the affected Instagram account and enable multi-factor authentication if not already active. Review the account for unauthorized activity, including posts, messages, or linked applications. Additionally, monitor other accounts that may share the same or similar credentials for signs of compromise. If financial or personal data was exposed, consider reporting the incident to relevant authorities and credit monitoring services to mitigate potential identity theft risks. The domain has since been taken offline, but vigilance is advised for similar threats.