download[.]plinko[.]org[.]kz

The domain download.plinko.org.kz impersonates Google, posing as a download page for a supposed app on Google Play. Despite its offline status, it has been flagged as malicious by 4 out of 94 vendors on VirusTotal. This indicates a significant threat level, further underscored by its inclusion in PhishDestroy's blocklist.

This domain was hosted on an IP address in Kazakhstan, under the organization Pskz Hosting VPS. The SSL certificate was issued by Let's Encrypt, a common choice for malicious actors due to its free and automated nature. The domain was created and detected by PhishDestroy on the same day, suggesting a rapid deployment aimed at exploiting the initial hours of availability before detection systems could respond.

The scam's page title, rendered in Cyrillic, suggests a targeted attack on Russian-speaking users, potentially leveraging the familiarity and trust associated with Google Play. The platform risk score of 56 out of 100 reflects a moderate threat level, considering both the impersonation of a major brand and the rapid takedown of the domain.

PhishDestroy's early detection highlights the importance of proactive threat monitoring. By capturing this domain within the critical window before widespread detection, PhishDestroy helps mitigate potential harm. This case underscores the ongoing challenge of domain-based scams, particularly those impersonating trusted brands like Google.