umtrust[.]kz

The domain umtrust.kz has been identified as a credential theft scam designed to deceive homeowners with false promises of legal refunds from unscrupulous builders. Analysis indicates the site employs social engineering tactics, specifically targeting Russian-speaking users with the page title 'Законно вернем ваши деньги от 3х дней от недобросовестных строителей.' The domain is currently offline, but prior activity confirms malicious intent. Infrastructure analysis reveals the domain was flagged by 4 of 95 security vendors on VirusTotal, indicating moderate detection but sufficient evidence of malicious behavior. It resolves to the IP address 94.247.134.150 and is associated with a Let's Encrypt SSL certificate, a common tool used by threat actors to lend superficial legitimacy. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100, further corroborating its fraudulent nature. Technologies detected on the site include YouTube, jQuery, and Facebook Pixel, which may have been exploited to enhance credibility or track victims. As of the latest assessment, umtrust.kz has been taken offline, though the infrastructure remains a potential risk for future abuse. Organizations and individuals are advised to block the domain and its associated IP (94.247.134.150) at the network level. Users who may have interacted with the site should immediately reset credentials for any accounts accessed during the exposure window and monitor for unauthorized activity. Security teams should treat this domain as a confirmed threat and include it in phishing awareness training to prevent similar incidents.