imc-msk[.]ru

Analysis of imc-msk.ru shows a domain that was created on January 09, 2025 through the REGRU-RU registrar and is currently taken offline. The domain resolves to IP address 91.236.116.20, which belongs to AS42237 w1n ltd and is geolocated in Sweden. DNS resolution is provided by ns1.armadns.com and ns2.armadns.com. No TLS certificate is presented, meaning the site served only HTTP traffic when it was reachable.

The page title observed during the brief crawl was "krab1 - интегрированные AT решения для бизнеса," a Russian‑language phrase that does not correspond to a known legitimate brand, suggesting the content was likely used as a lure. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, indicating that at least one reputable anti‑phishing service has flagged it. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. VirusTotal scans reported four detections out of ninety‑five scanners, providing independent confirmation of malicious activity.

While the exact phishing kit or target brand is not disclosed, the combination of a low trust score, blocklist presence, multiple vendor detections, and the absence of SSL makes the domain high‑risk for credential harvesting or other fraudulent behavior. Defenders should ensure that imc-msk.ru is added to outbound and inbound deny lists across firewalls, proxy servers, and DNS filtering solutions. Monitoring of the hosting IP 91.236.116.20 for any re‑activation or new domains associated with the same ASN is advised, as threat actors often reuse infrastructure. Continuous re‑evaluation of the domain’s status in threat intel feeds is recommended, given the recent offline state may change if the operators reactivate the site.