chernovetskyifund[.]ge

This domain is flagged as an active credential harvesting phishing threat under investigation. Analysis indicates a targeted attempt to deceive users into disclosing login credentials, financial details, or other sensitive information through fraudulent web forms or spoofed interfaces. The domain exhibits infrastructure patterns consistent with phishing campaigns, including the use of content delivery networks to obscure origin servers and evade detection. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.26.3.60, hosted on AS13335 (Cloudflare, Inc.) in the United States. It was registered on January 26, 2017, through proservice ltd and remains active. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites to appear legitimate. Despite zero detections out of 95 engines on VirusTotal, the domain appears on one security blocklist, specifically PhishDestroy, suggesting early-stage detection by specialized threat intelligence sources. Mitigation steps for this credential harvesting phishing threat include immediate blocking of the domain and its associated IP (104.26.3.60) at the network perimeter. Organizations should implement DNS filtering to prevent resolution and deploy email security controls to block messages containing links to chernovetskyifund.ge. Endpoint protection systems should be updated to recognize the domain as malicious, and users should be educated on identifying phishing tactics, particularly those mimicking financial or investment services. Given the domain's long registration history, security teams should investigate for potential lateral movement or persistence mechanisms in environments where access may have occurred prior to detection.