vzj4noiy-ozon[.]reliableortho[.]com

This domain poses a significant credential harvesting threat by impersonating Ozon, a major e-commerce platform. Visitors are presented with fraudulent login pages designed to capture usernames, passwords, and payment details under the guise of legitimate account verification or order processing. The site may also distribute malware through fake software updates or invoice attachments, exploiting user trust in the Ozon brand to bypass security awareness filters.

Analysis indicates the domain was registered on January 19, 2025, through Unstoppable Domains Inc., a registrar frequently associated with newly created malicious infrastructure. It resolves to the IP address 207.89.18.20, which has been linked to prior phishing campaigns targeting regional online marketplaces. As of the latest scan, only 1 out of 95 security vendors on VirusTotal flag this domain, suggesting either recent activation or evasion techniques designed to delay detection. The use of a Let's Encrypt SSL certificate further enhances the illusion of legitimacy, as users may interpret the presence of HTTPS as a sign of safety.

If this domain was visited, immediate action is required to mitigate potential compromise. Users should terminate any active sessions, clear browser cache and cookies, and run a full system scan using updated security tools. All credentials entered on the site must be considered exposed and should be changed from a separate, trusted device. Financial institutions should be notified if payment details were submitted, and transaction histories reviewed for unauthorized activity. Organizations should block the domain and its resolving IP at the network perimeter to prevent further exposure, while monitoring for signs of lateral movement or data exfiltration.