remote-webpage[.]ru

The domain remote-webpage.ru was registered on 22 December 2025 via the REGRU-RU registrar. It resolves to the IPv4 address 65.21.174.205, which belongs to Hetzner Online GmbH (AS24940) located in Finland. The host presents an HTTPS service signed by a Let’s Encrypt R13 certificate, but the HTTP response returns status code 403, indicating restricted access. The site advertises itself with the page title “DApps Service – Trusted Platform”, a wording commonly used in cryptocurrency‑related services. Intelligence classifies the activity as a fake airdrop campaign, a variant of phishing that lures victims with promises of free token distributions.

Infrastructure analysis shows the domain is serviced by the nameservers ns41.link-host.net and ns42.link-host.net, each listed twice in the record. The web server software is identified as Nginx, and the page includes the Liveinternet analytics tag. A Gridinsoft trust score of 0 out of 100 reflects a lack of reputation. VirusTotal scans have reported that nine of ninety‑three security vendors flagged the domain, confirming malicious behavior. The domain is currently listed on five public blocklists and has been blocked by security products such as PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura.

The combination of a recent registration, low trust score, presence on multiple blocklists, and detection by several anti‑phishing services indicates a high‑risk profile. However, the exact payload and user‑facing content have not been publicly disclosed, leaving the details of the phishing lure uncertain. Defenders should block any outbound connections to 65.21.174.205, add remote-webpage.ru to DNS sinkhole lists, and monitor for attempted credential submissions targeting the “DApps Service” brand. Continuous re‑scanning of the domain with updated VirusTotal and other sandbox services is advised to capture any evolution of the malicious payload.