chernovetskiy[.]com[.]ua

Analysis of chernovetskiy.com.ua indicates an active credential phishing operation targeting Ukrainian-language users. The domain, registered on January 9, 2009, through ТОВ "Інтернет Інвест," currently resolves to 159.223.22.97, hosted on DigitalOcean’s AS14061 infrastructure in Germany. The site presents itself as a personal page titled "Книги - Персональный сайт Леонида Черновецкого," though its classification as credential phishing suggests the content is likely deceptive, designed to harvest login credentials or personal data. Infrastructure analysis reveals the use of Cloudflare nameservers (darl.ns.cloudflare.com and wally.ns.cloudflare.com), which may obscure the true origin of traffic. Detected technologies include Nginx on Ubuntu, Slick, Mailgun for email handling, jQuery, HSTS enforcement, and tracking tools such as Google Analytics and Facebook Pixel. The presence of Mailgun and tracking pixels raises concerns about potential data exfiltration or follow-up phishing attempts via email. The SSL certificate is issued by Let’s Encrypt (E7), providing encryption but not validating the site’s legitimacy. The domain is flagged by one security vendor on a blocklist and has a trust score of 0/100, reinforcing its high-risk classification. While only one vendor currently detects it, the combination of hosting on a known bulletproof provider, use of evasion techniques, and the credential phishing classification warrants immediate defensive action. Defenders should block the domain at the DNS or proxy level, monitor for connections to 159.223.22.97, and investigate any associated email campaigns leveraging Mailgun. Further analysis of the site’s content and payloads is recommended to confirm the exact phishing mechanics and targeted credentials.