s-klei[.]ru

Analysis of the domain s-klei.ru indicates it was associated with generic phishing activity, currently offline as of July 25, 2026. The domain was registered on February 21, 2026, and resolved to the IP address 185.246.130.64, hosted under AS42237 (w1n ltd) in Sweden. The SSL certificate is classified as R12, a non-standard or low-trust designation often observed in malicious infrastructure. The page title was identified as 'Captcha,' a common tactic used in phishing sites to deceive users into interacting with fraudulent prompts or bypassing security checks.

Detection data is limited but notable: one of 93 security vendors on VirusTotal flagged the domain, and it appears on a single security blocklist. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk. The domain was also blocked by PhishDestroy, a specialized anti-phishing service. No brand impersonation or specific phishing kit was identified in the available data, and the exact content or target of the phishing attempt remains unconfirmed.

Defenders should treat this domain as part of a broader phishing campaign, particularly given its hosting provider and SSL certificate profile. While the domain is currently offline, historical resolution to 185.246.130.64 and its registration details may warrant monitoring for reactivation or related infrastructure. Network-level blocks or DNS sinkholing could mitigate residual risk. Further investigation into the hosting ASN and adjacent IPs may reveal additional compromised or malicious domains.