avanmarketcs[.]ru

avanmarketcs.ru is flagged as a high‑risk generic phishing site. The front‑end presents a Russian‑language marketplace titled “Avan Market — купить или продать скины”, mimicking legitimate skin‑trading platforms. The site returns HTTP 200 and is reachable over TLS with a Let’s Encrypt certificate, indicating active service as of the report date. Technical resolution shows the domain points to IP 87.236.16.13, hosted in Russia and assigned to ASN 198610 (Beget LLC). Registration occurred on 12 March 2026 via the BEGET‑RU registrar, and the domain uses the provider’s default nameservers (ns1.beget.com, ns1.beget.pro, ns1.beget.ru, ns2.beget). The web stack consists of WordPress on MySQL behind Nginx, with client‑side libraries including jQuery, jQuery Migrate and Yandex Metrika. MX records are directed to mx1.beget.com and mx2.beget.com. Threat intelligence indicates that the site is listed on a single security blocklist and has been blocked by PhishDestroy. VirusTotal reports a single vendor detection out of 95, reflecting low visibility but not a lack of malicious intent. The page title and marketplace theme suggest credential harvesting for gaming accounts, yet the exact phishing form or payload has not been captured, leaving the precise data‑collection mechanism uncertain. Defenders should treat avanmarketcs.ru as malicious. Immediate actions include adding the domain and its IP to network blocklists, configuring DNS sinkholing, and updating email security policies to flag communications that reference “Avan Market” or related skin‑trading terminology. Continuous monitoring of the domain’s DNS records and certificate status is advised, as changes could indicate migration to new hosting infrastructure. End‑users should be warned that any unsolicited request to log in or trade skins on this site is likely fraudulent.