irit[.]rastamojim[.]ru

This domain, irit.rastamojim.ru, is identified as a credential theft operation designed to harvest user login credentials through deceptive web pages. Analysis indicates the site mimics legitimate login portals, tricking visitors into submitting sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. The domain’s infrastructure and content align with known tactics used in targeted phishing campaigns, where stolen credentials are later exploited for unauthorized access to accounts, financial fraud, or further malicious activities. Infrastructure analysis reveals multiple technical indicators confirming the domain’s malicious nature. The domain resolves to the IP address 83.69.237.67, hosted on AS12616 (Citytelecom LLC) in Russia, and was registered on February 21, 2026, through RU-CENTER-RU. It appears on one security blocklist and is flagged by Google Safe Browsing as a phishing threat. VirusTotal reports 20 out of 95 security vendors detecting the domain as malicious, with no valid SSL certificate present, increasing the risk of interception or manipulation of transmitted data. Users who visited irit.rastamojim.ru should assume their credentials or other sensitive information may have been compromised. Immediate actions include changing passwords for any accounts accessed while the domain was visited, enabling multi-factor authentication where available, and monitoring accounts for unauthorized activity. If financial or personally identifiable information was entered, affected individuals should report the incident to relevant authorities and consider credit monitoring services. System scans using updated security tools are recommended to detect any secondary infections or malware introduced through the site.