drugon2[.]biz

This domain, drugon2.biz, is currently flagged as an active credential harvesting phishing site designed to impersonate CAPTCHA verification processes. The page title, 'Вы не робот?', suggests a targeted campaign aimed at Russian-speaking users, likely attempting to collect login credentials or personal information under the guise of a security check. As of the latest analysis, the domain remains operational and has not been widely detected by automated security systems. Infrastructure analysis reveals that drugon2.biz was registered on October 17, 2023, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 91.206.71.90, which has been linked to other malicious activities in previous threat intelligence reports. Despite leveraging Cloudflare for content delivery and security obfuscation, the domain has evaded detection by all 95 vendors on VirusTotal, indicating a low initial detection rate. It appears on only one security blocklist, suggesting limited visibility within the broader threat intelligence community. The current risk assessment indicates that drugon2.biz poses a moderate to high threat due to its active status, targeted phishing tactics, and use of evasive infrastructure. Organizations and individuals are advised to block the domain and its associated IP address (91.206.71.90) at the network level. End-users should be educated to recognize CAPTCHA-themed phishing attempts, particularly those using non-Latin characters or unusual verification prompts. Monitoring for further detections on security platforms is recommended, as the domain may gain additional flags as awareness of the campaign increases.