app-rosafest[.]ru

The domain app-rosafest.ru is identified as a phishing portal specifically designed to impersonate the Rosafest event and the Russian Fast Payment System (SBP). Analysis indicates this domain presents itself as a legitimate payment gateway, likely targeting users attempting to make transactions or register for the Rosafest event. The page title, СБП х Розафест, directly references both SBP and Rosafest, reinforcing the deception. Currently, the domain is offline, but its prior activity poses a significant credential and financial theft risk to unsuspecting visitors. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered through REGRU-RU and resolves to the IP address 51.250.114.71. It was flagged by 4 of 95 security vendors on VirusTotal, while Gridinsoft assigned it a trust score of 0 out of 100. The domain appears on two security blocklists, including PhishDestroy and OISD. Detected technologies include Node.js, React, Nginx, Next.js, Yandex.Metrika, and Webpack, suggesting a modern, dynamic web application built to mimic legitimate payment portals. The domain was created on February 21, 2026, an anomalous date that may indicate domain spoofing or incorrect registry data. Given the elevated risk level and confirmed phishing activity, users are strongly advised to avoid any interaction with app-rosafest.ru. Financial institutions and cybersecurity teams should block the domain and its associated IP at the network level. Individuals who may have entered credentials or payment details on this site should immediately change passwords, enable multi-factor authentication, and monitor accounts for unauthorized transactions. Organizations are encouraged to conduct internal awareness training to educate users on recognizing phishing attempts involving payment systems and event-related scams.