pasportov-zakupka[.]org

This domain, pasportov-zakupka.org, is flagged as an active document forgery phishing site targeting Russian passport procurement. Registered on June 19, 2026, through Fewmoretaps OU d/b/a Trustname.com, the domain resolves to IP 45.74.7.149, hosted by Virtualine Technologies in the United Kingdom. Infrastructure analysis reveals Cloudflare nameservers (hattie.ns.cloudflare.com, yoxall.ns.cloudflare.com) and an Nginx web server, a common configuration for phishing sites seeking to obscure origin and evade takedowns. The page title, 'Купить паспорт РФ без предоплаты можно у нас' (translated: 'Buy a Russian Federation passport without prepayment here'), explicitly advertises fraudulent document services, a clear indicator of illicit intent. The domain appears on one security blocklist and is recognized in a single AlienVault OTX threat intelligence pulse, suggesting limited but confirmed malicious activity. Four of ninety-one security vendors on VirusTotal flag the domain, though the specific detection logic remains unconfirmed. The SSL certificate, issued by Let's Encrypt (YR2), provides basic encryption but does not validate legitimacy, as certificates are routinely abused by threat actors. The domain's Gridinsoft trust score of 0/100 further corroborates its high-risk classification. While the exact content and operational mechanics of the site remain unanalyzed, the combination of infrastructure, registration details, and advertised service strongly indicates a document forgery phishing operation. Defenders should treat this domain as hostile, block resolution at the DNS level, and monitor for related indicators such as the IP address, nameservers, and registration provider. Further investigation into associated domains registered through Fewmoretaps OU may reveal additional threats in this campaign.