ufa[.]royal-change[.]ru

This domain, ufa.royal-change.ru, is identified as a brand impersonation threat specifically targeting Google users. Despite displaying content related to gold purchasing services in Ufa, Russia, infrastructure analysis confirms its use in phishing campaigns designed to harvest credentials or distribute malicious payloads under the guise of legitimate Google services. The deceptive page title, "Скупка золота дорого в Уфе - выгодно продать золото по высокой цене | Royal Change," serves as a smokescreen to obscure its true intent from casual inspection or automated detection systems.

Technical indicators substantiate the elevated risk classification. The domain was registered on April 03, 2020, through REGRU-RU and currently resolves to the IP address 185.22.234.174. It is flagged by 4 out of 95 security vendors on VirusTotal, appears on one security blocklist, and holds a Gridinsoft trust score of 0/100. The SSL certificate is issued by Let's Encrypt, and the server infrastructure includes Nginx with Yandex.Metrika analytics, which may be leveraged for tracking victim interactions or obfuscating malicious activity.

Users who have visited ufa.royal-change.ru or interacted with its content should immediately revoke any entered credentials, particularly those associated with Google accounts. Scan the affected system for malware using updated security tools, and monitor for unauthorized access or anomalous activity. Reset passwords for all potentially exposed accounts, enable multi-factor authentication where available, and report the incident to relevant security teams or abuse contacts. Exercise heightened caution with unsolicited communications referencing this domain or similar impersonation attempts.