market[.]old[.]com[.]ru

PhishDestroy identifies market.old.com.ru as an active phishing domain posing as a generic online marketplace login portal. This site specifically functions as a credential harvesting trap, tricking users into submitting email or password combinations that are immediately exfiltrated to malicious actors. The domain is not yet flagged on public blocklists and benefits from a recently issued Let’s Encrypt SSL certificate, which increases perceived legitimacy and reduces immediate suspicion from visitors. Security telemetry shows this infrastructure is hosted on IP address 89.111.143.197, a netblock with a history of hosting low-reputation services.

This domain was flagged by PhishDestroy with the internal seed 0c013c and is currently classified as active and under investigation. Public scanning via VirusTotal returns zero detections across 95 antivirus engines as of the latest scan window. The domain was registered through a privacy-protected registrar and shows a creation timestamp within the last 30 days, indicating recent operational deployment. Despite its newness, the domain has already been observed in at least one confirmed malicious campaign targeting users through impersonation of a legitimate e-commerce login interface. Its lack of historical reputation and absence of detection signatures make it particularly dangerous to unsuspecting users.

Users who may have visited market.old.com.ru should immediately audit any accounts used on the site. If credentials were entered, change passwords immediately and enable multi-factor authentication on all associated accounts. Scan local devices for malware using reputable tools and monitor accounts for signs of unauthorized access or fraudulent transactions. Report the domain to PhishDestroy for deactivation and share any interaction details to strengthen collective defense. Avoid re-engaging with this domain, as it continues to operate and may be weaponized further as threat actors refine their tactics.