pingvids[.]icu

This domain, pingvids.icu, is flagged as a generic phishing site specializing in fake login portals. Analysis of the page title "Кружки" suggests targeting of Russian-speaking users, likely through credential harvesting rather than cryptocurrency drainers or brand impersonation. No known phishing kits or affiliate IDs were identified in the available telemetry, though the use of Python and HTTP/3 may indicate custom or obfuscated infrastructure to evade detection. Technical indicators reveal the domain was registered on April 24, 2026, through the registrar FewMoreTaps OÜ. It resolves to the IP address 95.216.114.217, a host previously associated with other low-reputation domains. VirusTotal shows 0/95 detections, indicating no antivirus engines currently flag the domain as malicious. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. The domain appears on one security blocklist, specifically PhishDestroy, and has a trust score of 0/100, reinforcing its high-risk classification. The domain is currently offline, though this status may change. No active phishing pages or payloads were observed during the last crawl, but the infrastructure remains intact. Organizations should monitor for re-activation, particularly on networks with Russian-speaking users. Defenders are advised to preemptively block the domain and IP at the perimeter, update endpoint detection rules to flag the page title "Кружки" in web traffic, and conduct retrospective hunting for connections to 95.216.114.217. Given the zero-detection status on VirusTotal, reliance on signature-based defenses alone is insufficient; behavioral analysis and network segmentation should be prioritized to mitigate credential theft risks.