xn--j1admm[.]xn--p1ai

This domain, xn--j1admm.xn--p1ai, is identified as a generic phishing portal designed to impersonate the legitimate entity МРУК, a recognized organization in Russian-speaking regions. Analysis indicates the site employs standard phishing tactics aimed at harvesting user credentials, likely through fake login forms or deceptive prompts. No specific drainer kit or cryptocurrency-related fraud mechanisms have been confirmed at this stage, though the infrastructure aligns with credential theft operations targeting regional users. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 1 out of 95 security vendors on VirusTotal, suggesting limited but existing detection. It was registered on April 22, 2026, via the RU-CENTER registrar, a provider commonly associated with domains targeting Russian-speaking audiences. The domain resolves to the IP address 37.140.192.242, a host with no prior confirmed malicious associations but located in a region frequently used for phishing infrastructure. Google Safe Browsing does not currently list the domain, though it appears on one security blocklist, and the Gridinsoft trust score is 0 out of 100, reinforcing its high-risk classification. The domain is currently offline, likely due to takedown actions or voluntary suspension by the hosting provider. Despite its inactive status, residual risk remains for users who may have interacted with the site prior to its removal. Organizations are advised to monitor for credential reuse attempts and update blocklists to include the domain and its associated IP. Users should verify the legitimacy of any communications purporting to be from МРУК and report suspicious activity to relevant security teams for further investigation.