garantpasport[.]com

This domain is flagged as an elevated-risk phishing site specializing in Russian passport fraud. Analysis of the page title, "Паспорт гражданина России купить – без предоплаты!" (translation: "Buy Russian citizen passport – no prepayment!"), confirms the domain targets individuals seeking fraudulent identity documents. The threat type falls under document fraud phishing, a subset of credential and identity theft schemes that exploit victims through deceptive offers of government-issued documents. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on April 21, 2026, through Fewmoretaps OU d/b/a Trustname.com, an offshore registrar frequently associated with high-risk domains. It resolves to IP address 188.137.178.202 and is currently offline. Detection engines flagged the domain with 7/95 hits on VirusTotal, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and employs a Let's Encrypt SSL certificate. Detected technologies include WordPress, MySQL, PHP, Nginx, and jsDelivr, suggesting a standard web stack potentially vulnerable to exploitation. Mitigation steps for this specific threat type include immediate domain blacklisting in enterprise security gateways and endpoint protection systems. Network administrators should block the IP address 188.137.178.202 and monitor for connections to the registrar's infrastructure. Security teams should alert employees and users about document fraud phishing schemes, particularly those offering government-issued documents without verification. Financial institutions and identity verification services should flag transactions linked to this domain or similar fraudulent document offers. Given the offline status, continuous monitoring for reactivation or domain rebranding is recommended, as threat actors frequently reuse infrastructure for new phishing campaigns.