en-aliexpress[.]com

This domain is classified as a high-risk credential harvesting phishing site designed to deceive Russian-speaking users. Analysis indicates it impersonates the legitimate AliExpress e-commerce platform, using localized content and currency to appear authentic. The page title explicitly mimics the official AliExpress Russian portal, increasing the likelihood of successful social engineering attacks against regional users. Infrastructure analysis reveals the domain en-aliexpress.com is registered through REG.RU LLC and resolves to the IP address 217.107.219.53. The site employs a Let's Encrypt SSL certificate (R13), which, while providing encryption, does not validate legitimacy. VirusTotal detection shows 4 out of 95 security vendors flag the domain as malicious, a relatively low but significant ratio given the domain's recent activation. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, indicating cross-industry recognition of its fraudulent nature. No creation date was provided, but the active status and recent blocklist inclusions suggest recent deployment. Mitigation requires immediate blocking of the domain and its associated IP at the network perimeter. Security teams should deploy indicators of compromise (IOCs) including the domain en-aliexpress.com, IP 217.107.219.53, and SSL certificate thumbprint for endpoint detection and response (EDR) systems. User awareness training should emphasize verification of domain authenticity, particularly for localized versions of global e-commerce sites. Monitoring for credential reuse attempts from harvested accounts is advised, as phishing victims often reuse passwords across multiple platforms. Network traffic analysis should prioritize detection of connections to this IP or domain, particularly from regions targeted by the localized content.