coweb-host[.]ru

The domain coweb-host.ru was registered on 23 May 2008 through RU-CENTER-RU. Infrastructure analysis shows it resolves to 89.223.125.178, an address owned by AS9123 JSC TIMEWEB in Russia. The host runs Ubuntu with an Nginx web server and presents a Let’s Encrypt R13 certificate. DNS records list ns1.coweb-host.ru and ns2.coweb-host.ru both pointing to the same IP, and an additional ns1.softrus.ru entry. HTTP probing returned a 404 status, and the page title observed was "Хостинг сайта, хостинг 1С-Битрикс, администрирование сервера, VDS", indicating a hosting‑service oriented landing page rather than a targeted credential‑capture page.

The site is currently taken offline. Reputation data shows the domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal scans recorded eight detections out of ninety‑five participating vendors, confirming malicious classification by multiple AV engines. AlienVault OTX references the domain in sixteen separate threat pulses, reinforcing its association with phishing campaigns. No additional public threat‑intel sources were identified.

The evidence confirms that coweb-host.ru has been used in phishing operations, likely to lure victims with hosting‑service terminology. Uncertainty remains regarding the specific phishing kit or the exact victim vector, as the captured page content has not been publicly released. Defenders should block the domain and its associated IP at perimeter firewalls, update DNS filtering lists, and monitor for any resurgence of the host under the same IP or nameserver configuration. Continuous observation of the AS9123 block for new registrations is recommended, as well as periodic re‑scanning of the IP address for emerging payloads.