sarmat24[.]biz

PhishDestroy identifies sarmat24.biz as an active generic phishing domain operating since March 28, 2020. This domain poses an elevated risk by leveraging deceptive tactics to impersonate legitimate banking login interfaces, tricking users into surrendering sensitive credentials. No specific drainer kit or brand impersonation has been confirmed, but its structure suggests a focus on financial fraud.

This domain exhibits multiple red flags confirmed by forensic analysis. VirusTotal flags 1 out of 95 security vendors, indicating limited but present detection. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, it resolves to IP 91.206.71.105 and holds a Google Trust Services SSL certificate—a tactic often exploited to appear legitimate. The domain was created on March 28, 2020, and remains unblocked by Google Safe Browsing (GSB) at the time of analysis.

Current status confirms active operation with elevated risk potential. Immediate response includes blocking the domain and IP at network and endpoint levels. Users are advised to avoid accessing sarmat24.biz and report any interaction. While current blocklist adoption is low, proactive threat intelligence integration is critical to prevent credential harvesting campaigns. Remaining risk stems from potential undetected variants or infrastructure pivots, necessitating continuous monitoring.