new-pasportist[.]com

This domain, new-pasportist.com, is actively serving a phishing page targeting individuals seeking fraudulent Russian Federation passports. The site presents itself under the title 'Паспорт РФ - купить быстро и без предоплаты,' which translates to an offer for quick passport acquisition without prepayment. Analysis indicates the domain was registered on June 17, 2026, through Fewmoretaps OU, operating under the Trustname.com registrar. The infrastructure resolves to the IP address 85.208.186.116, which has been associated with multiple malicious activities in recent threat intelligence reports. Security vendor detection on VirusTotal shows that 6 out of 95 engines flag this domain as malicious, while AlienVault OTX lists it in 14 distinct threat intelligence pulses. The domain is currently blocked by at least two security blocklists, including PhishDestroy and BLP-Malware, and maintains a trust score of 0/100 according to Gridinsoft. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites, providing no definitive indication of intent but ensuring encrypted connections that may lend false credibility to victims. The domain remains operational as of July 12, 2026, with no signs of takedown or mitigation. While the specific phishing kit or backend infrastructure has not been fully analyzed, the combination of domain registration details, hosting IP, and vendor detections strongly suggests a coordinated fraud operation. Defenders should treat this domain as high-risk and prioritize blocking both the domain and its associated IP address in network security controls. Additional monitoring of related infrastructure, particularly domains registered through the same registrar or resolving to the same IP, is recommended to identify potential linked threats.