farmasi-bk[.]com

This domain, farmasi-bk.com, is confirmed to host a credential theft operation targeting individuals seeking permanent residency in Moscow. Analysis indicates the site impersonates a legitimate housing agency, using the page title 'Постоянная прописка в Москве и области — от собственника | Агентство собственников жилья' to lend false credibility. The fraudulent scheme likely collects personal data, payment details, or identity documents under the pretense of facilitating residency registration. No cryptocurrency drainer kit or brand impersonation of a specific corporation was detected, distinguishing this as a localized credential harvesting campaign. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar with a history of hosting fraudulent sites. It resolves to the IP address 45.10.243.69 and is secured with a Let's Encrypt SSL certificate, a common tactic to appear legitimate. VirusTotal reports 3 out of 95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and was previously documented in a threat intelligence pulse on AlienVault OTX. No detection by Google Safe Browsing was noted at the time of analysis. The domain has been taken offline, likely in response to detection by security systems such as PhishDestroy. However, residual risk remains due to the transient nature of such infrastructure. Affected users may still face follow-up attacks via collected credentials or personal data. Organizations are advised to monitor for related domains registered through the same registrar or resolving to the identified IP. Individuals who interacted with the site should assume compromise of submitted information and take steps to secure accounts, monitor for identity theft, and report the incident to relevant authorities.