potok-cash[.]eu

Analysis of potok-cash.eu, observed on July 24 2026, indicates that the domain is currently offline. The authoritative name servers are ns1.vdsina.com, ns2.vdsina.com, ns4.vdsina.com, all pointing to the VDS hosting provider. DNS resolution maps the domain to IP 194.246.81.11, which belongs to AS216071 SERVERS TECH FZCO and is geolocated in the Netherlands. No TLS certificate was presented during connection attempts, confirming the absence of HTTPS protection. The sole page title retrieved before takedown reads “Проект ПотокCash – Главная страница”, suggesting a Russian‑language landing page possibly related to a financial service named ПотокCash.

Gridinsoft assigned a trust score of 0 out of 100, indicating extreme suspicion. VirusTotal recorded a single positive detection out of 95 scanned engines, and the domain appears on one external blocklist. PhishDestroy has also listed the host as malicious. Registration was performed through PDR Ltd. operating under the PublicDomainRegistry.com brand. The combination of a low trust score, a positive VirusTotal flag, inclusion on a blocklist, and explicit classification by PhishDestroy supports a high confidence that the site was used for phishing.

Because the site is offline, active payload retrieval is not possible, and the exact phishing vector (e.g., credential harvesting form) cannot be confirmed. Defenders should continue to block the IP address 194.246.81.11 at network perimeter, update DNS filtering to deny resolution of potok-cash.eu, and monitor for any re‑registration or use of the same hosting infrastructure. Additional forensic collection of any cached copies of the page title or HTTP headers could further corroborate the phishing intent. Until the domain reappears, the current evidence is sufficient to maintain an elevated risk posture.