sikard[.]site

The domain sikard.site was registered on December 04, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently hosted on the TIMEWEB network (ASN 9123, JSC TIMEWEB) in Russia. DNS resolution points to IP address 92.53.96.141 and the authoritative nameservers are ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, and ns4.timeweb.org. An HTTPS service is presented using a GlobalSign nv‑sa certificate chained to the GlobalSign GCC R3 DV TLS CA 2020, indicating a valid‑looking TLS configuration. HTTP requests receive a 302 redirect response, a pattern often used to forward victims to malicious payloads or credential‑harvesting pages.

The site’s sole visible attribute is the page title "СИКАРД - Изготовление металлоконструкций: ворота, навесы, перила, лофт мебель", which describes a metal‑fabrication business but provides no direct evidence of malicious content. Threat intelligence shows the domain appears on two public blocklists, specifically PhishDestroy and ScamSniffer, and has been referenced in a single AlienVault OTX pulse. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal scans report that four of ninety‑five security vendors flagged the domain, reinforcing the suspicion of phishing activity.

Despite the limited public content, the convergence of a recent registration, Russian hosting, low trust score, blocklist listings, and multiple vendor detections supports a high‑risk classification. The current status is active, meaning the site may continue to host credential‑stealing or fraud‑related infrastructure. Defenders should block network traffic to 92.53.96.141, add sikard.site to URL filtering and email security policies, and monitor for any related hash or payload indicators that may emerge from future analyses. Continuous re‑evaluation is advised, as the exact phishing payload and targeted brands have not yet been disclosed.