russs-pasport[.]com

This domain, russs-pasport.com, is identified as a generic phishing operation targeting individuals seeking fraudulent Russian passports. Analysis of the page title, "Нужен паспорт России? Без предоплаты с проводкой по базе," indicates a scam offering counterfeit government documents without upfront payment, leveraging claims of database verification to appear legitimate. No specific brand impersonation or cryptocurrency drainer kit is evident, but the scheme aligns with broader document fraud and identity theft operations. The domain lacks direct ties to known phishing frameworks but exhibits characteristics of low-effort, high-volume social engineering campaigns designed to exploit individuals in need of forged credentials.

Technical indicators confirm elevated risk levels. The domain resolves to IP address 185.110.92.47 and was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. VirusTotal detection shows 7 out of 95 security vendors flagging the domain as malicious, while AlienVault OTX records its presence in one threat intelligence pulse. The domain appears on a single security blocklist and holds a Gridinsoft trust score of 0/100. Google Safe Browsing status is not explicitly provided, but the combination of registrar reputation, detection rates, and blocklist inclusion strongly suggests malicious intent.

As of the latest assessment, russs-pasport.com has been taken offline, likely due to enforcement actions or hosting provider intervention. The domain is blocked by at least one security solution, and its infrastructure has been disrupted. However, residual risk persists due to the potential for threat actors to re-establish operations under a new domain or IP address. Individuals who may have interacted with this domain are advised to monitor for unauthorized identity usage, particularly in relation to government-issued documents. Organizations should update security controls to block the IP address 185.110.92.47 and domains registered via NICENIC INTERNATIONAL GROUP CO., LIMITED, as part of proactive threat mitigation. Continuous monitoring of related infrastructure is recommended to detect potential resurgence or lateral movement within the same threat cluster.