kolesa[.]group

The domain kolesa.group was registered on March 28, 2019 through the registrar REG.RU LLC and continues to resolve to the IPv4 address 185.143.129.76. Its authoritative name servers are ns1.kolesa.kz, ns2.kolesa.kz, and ns3.kolesa.kz. The domain is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service.

VirusTotal records indicate that the domain has been scanned by 91 separate antivirus and URL‑reputation vendors, none of which have returned a detection at the time of analysis. Despite the lack of vendor detections, the presence on a blocklist and the active block by PhishDestroy suggest that the infrastructure is being used for malicious purposes, consistent with the generic phishing classification supplied in the intelligence. The domain remains active as of the report date, July 24, 2026, and no further public evidence such as SSL certificate details, HTTP response codes, or page titles has been disclosed.

Because the observable data points to a potentially hostile hosting environment, defenders should consider adding 185.143.129.76 to network‑level deny lists, monitoring DNS queries for kolesa.group and its associated name servers, and ensuring that any inbound traffic from this host is blocked or sandboxed pending further investigation. Continuous re‑evaluation of the domain’s status on blocklists and periodic rescanning with threat‑intel platforms are recommended to capture any future changes in its malicious profile.