inst[.]nomadus[.]ru

The domain inst.nomadus.ru is currently active and flagged for credential theft, a specific subset of phishing targeting user login credentials. Analysis indicates the site mimics a travel or tourism portal, as evidenced by the page title 'В горы Кавказа - редизайн' (To the Caucasus Mountains - Redesign), likely designed to deceive Russian-speaking users into submitting sensitive information. No direct brand impersonation is confirmed, but the infrastructure aligns with credential harvesting tactics observed in regional phishing campaigns. Infrastructure analysis reveals the domain resolves to the IP address 2.26.76.93 and was registered through TIMEWEB-RU on December 14, 2025, a future date suggesting potential typosquatting or malicious registration practices. As of the latest scan, 18 of 95 security vendors on VirusTotal have flagged inst.nomadus.ru as malicious. The domain employs a Let's Encrypt SSL certificate, a common tactic to lend false legitimacy to phishing sites. No additional blocklist counts or trust scores were provided, but the combination of vendor detections and anomalous registration details underscores the high-risk classification. The domain remains active, and users are advised to exercise caution. Immediate recommendations include blocking the domain and IP at the network level, particularly for organizations with Russian-speaking users or travel-related services. End-users should avoid interacting with the site or submitting any credentials. Security teams are encouraged to monitor for related indicators, such as the IP 2.26.76.93 or domains registered through TIMEWEB-RU with similar naming patterns, as these may indicate broader campaign infrastructure. Regular updates to endpoint protection and phishing awareness training are also advised to mitigate credential theft risks.