klad1[.]biz

This domain is flagged as an elevated-risk credential phishing infrastructure targeting users through a fake "Вы не робот?" (Are you not a robot?) verification page. Analysis indicates the domain was designed to harvest login credentials by mimicking legitimate security challenges, a common tactic in credential theft campaigns. The threat type is classified as generic_phishing with a focus on deception through social engineering rather than technical exploitation. Infrastructure analysis reveals the domain klad1.biz was registered on February 27, 2026, through NiceNIC International Group Co., Limited, and resolved to the IP address 91.206.71.112. It was detected by 2 out of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0/100. The domain appears on two security blocklists, PhishDestroy and BLP-Fraud, and was previously proxied through Cloudflare, a technique often used to obscure hosting origins and evade detection. The page title "Вы не робот?" further supports the credential harvesting intent, as it aligns with phishing kits designed to trick users into submitting sensitive information. Mitigation for this specific threat type involves several technical and procedural controls. Organizations should ensure endpoint protection systems are configured to block domains flagged by at least two security engines, particularly those with creation dates in the near future (indicative of rapid deployment in phishing campaigns). Network-level monitoring should be implemented to detect and block connections to the IP address 91.206.71.112 and domains registered through high-risk registrars like NiceNIC International Group Co., Limited. Users should be trained to recognize fake verification prompts, especially those using non-Latin scripts or generic page titles. Additionally, security teams should review logs for any prior interactions with this domain or IP, as compromised credentials may still be in use even after the infrastructure is taken offline.