nvu-bankrot-netdolgov[.]ru

The domain nvu-bankrot-netdolgov.ru was registered on December 11, 2024 via the REGRU-RU registrar. Infrastructure analysis shows the name servers ns1.armadns.icu and ns2.armadns.icu resolve the domain to the single IPv4 address 193.105.134.30, which belongs to AS42237 operated by w1n ltd and is geolocated in Sweden. No SSL certificate is associated with the host, indicating that the site is served only over HTTP; the current HTTP status is unavailable because the site has been taken offline. The page title reported by passive monitors is "kra46 - юридическая платформа AT для списания долгов", a phrase that does not reference a legitimate financial institution but aligns with the declared scam type of banking phishing.

Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, reflecting a high confidence in malicious intent. VirusTotal analysis shows that 15 of 95 scanned security vendors flagged the domain, confirming that multiple independent engines recognize it as suspicious. The domain appears on a single external security blocklist and is explicitly blocked by the PhishDestroy filtering service.

The overall threat posture is elevated due to the combination of a recent registration date, lack of encryption, low trust score, and multiple vendor detections. Defensive recommendations include adding the domain to local and network-wide blocklists, monitoring DNS queries for the associated IP address, and ensuring that any inbound traffic to 193.105.134.30 is denied. Since the site is offline, investigators should preserve the current indicators for future attribution and continue to watch for re‑hosting attempts that may reuse the same infrastructure.