johnboik[.]com

Analysis of johnboik.com shows a newly registered domain (created 28 April 2026) that is actively serving malicious content flagged by PhishDestroy. The site presents a page title encoded as "Работа сайта приостановлена", indicating a non‑English payload typical of phishing campaigns targeting Cyrillic‑speaking users. Infrastructure details reveal the domain is hosted on a Russian registrar (hosting.reg.ru) with nameservers ns1.hosting.reg.ru and ns2.hosting.reg.ru, resolving to IP 194.58.106.168 located in Russia. The SSL certificate is issued by Let’s Encrypt (R10), providing HTTPS encryption but offering no legitimacy. Reputation metrics are poor: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist. It has been referenced in a single AlienVault OTX pulse, confirming at least one external intelligence source has identified it as malicious. HTTP response code 403 suggests the site may be restricting access to certain requests, a common tactic to evade casual browsing while still serving targeted phishing pages to specific user agents. MX records point to mx1.hosting.reg.ru and mx2.hosting.reg.ru, indicating standard email handling but no evidence of abuse. VirusTotal reports that 91 scanning engines have examined the domain with no detections, a result that should not be interpreted as safety given the other corroborating indicators. Defenders should block johnboik.com at DNS, proxy, and firewall layers, monitor outbound traffic for connections to its IP, and update email security gateways to reject messages originating from its MX hosts. Continuous monitoring of the IP address and associated registrar activity is advised, as the infrastructure could be leveraged for additional phishing or credential‑harvesting campaigns.