cabinet[.]sekvoiavpn[.]ru

PhishDestroy has identified cabinet.sekvoiavpn.ru as a generic phishing threat with an elevated risk level. While no specific brand impersonation or known drainer kit was associated with this domain, its structure and behavior are consistent with phishing campaigns designed to harvest credentials or sensitive information. The domain was created on February 21, 2026, which is unusually recent and a common tactic for malicious sites to evade detection.

Technical indicators paint a concerning picture. VirusTotal reports only 1 out of 95 security vendors flagging this domain, suggesting it may be a novel or low-profile threat that has not yet been widely cataloged. The domain resolves to IP address 95.85.235.26 and was registered through REGRU-RU, a Russian registrar. It appears on 1 security blocklist, and Google Safe Browsing (GSB) status is not explicitly provided but the domain is offline. The SSL certificate is issued by Let's Encrypt with fingerprint E8, which is typical for quickly spun-up phishing sites.

Currently, the domain is offline, which may indicate it was taken down by the registrar or hosting provider after being reported. However, the risk remains elevated because the same threat actor could easily register new domains or reactivate this one. Users who may have interacted with cabinet.sekvoiavpn.ru should monitor their accounts for suspicious activity and change passwords if any credentials were entered. PhishDestroy recommends always verifying URLs before entering sensitive information and using security tools to block known phishing domains.