putty[.]org[.]ru

Analysis indicates that the domain putty.org.ru is actively serving a phishing site targeting users of the PuTTY SSH and Telnet client. The domain was registered through RU-CENTER and uses Cloudflare nameservers (lara.ns.cloudflare.com and sterling.ns.cloudflare.com), resolving to the IP address 172.67.155.173, which is part of AS13335 (Cloudflare, Inc.). The page title, "PuTTY: Telnet/SSH Клиент," explicitly references the legitimate PuTTY software, suggesting an attempt to deceive users seeking the official client. Infrastructure analysis reveals the use of Cloudflare services, including Browser Insights and HTTP/3, which may be employed to obfuscate the origin of the phishing content or enhance delivery performance. The domain was created on July 5, 2009, though this long registration history does not preclude malicious repurposing. MX records point to Cloudflare’s mail routing services (route1.mx.cloudflare.net and route2.mx.cloudflare.net), which could facilitate phishing emails or credential harvesting attempts. As of July 12, 2026, the domain appears on one security blocklist and is flagged by two of 95 security vendors in VirusTotal, indicating limited but present detection. The Gridinsoft trust score of 39/100 further supports the assessment of high risk. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently validate the legitimacy of the site’s content. Defenders should prioritize blocking this domain at the network level, particularly in environments where PuTTY is commonly used. Monitoring for related domains registered under similar patterns or using the same registrar may help identify additional threats. The exact content and functionality of the phishing page remain unconfirmed, but the combination of branding, infrastructure, and detection data justifies immediate mitigation.