youticket[.]kz

The domain youticket.kz is a phishing site engaged in brand impersonation targeting Instagram users. It presents itself as a legitimate service but is designed to harvest login credentials through social media phishing, posing an elevated risk to victims. No crypto drainer kit was detected, and the site is currently taken offline, though it was actively malicious prior to removal.

Technical indicators confirm the malicious nature of youticket.kz. As of analysis, 2 of 95 VirusTotal security vendors flagged the domain, including Gridinsoft (trust score 0/100) and SOCRadar. The domain was created on 2025-05-13 and resolves to the IP address 95.59.125.67, hosted on AS9198 JSC Kazakhtelecom in Kazakhstan. It appears on 2 security blocklists (PhishDestroy and ScamSniffer) but is not flagged by Google Safe Browsing. The SSL certificate is issued by Let's Encrypt (E8), and the observed page title was 'YouTicket'. Detected technologies include Node.js, Ubuntu, Ant Design, React, Nginx, Next.js, and Webpack. Nameservers are ns1.ps.kz, ns2.ps.kz, and ns3.ps.kz.

Victims of youticket.kz should immediately change their Instagram passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized posts or messages sent to contacts. Report the phishing domain to Instagram via their in-app reporting tools or at their dedicated phishing reporting page. Additionally, submit the domain to Google Safe Browsing, PhishTank, and other threat intelligence platforms to aid in takedown efforts and protect other users.