id-potok[.]cash

The domain id-potok.cash was a generic phishing site posing no specific brand impersonation or crypto drainer functionality. It operated as a broad credential-harvesting page targeting Russian-speaking users, as indicated by its page title 'Проект ПотокCash – Главная страница'. At the time of assessment, id-potok.cash had been taken offline, though it previously exhibited elevated risk due to its phishing intent and detection by security vendors.

Technical indicators for id-potok.cash include 2 of 95 VirusTotal vendors flagging the domain, including Gridinsoft and SOCRadar, with a Gridinsoft trust score of 0/100. The domain appeared on 2 security blocklists, PhishDestroy and ScamSniffer, but was not flagged by Google Safe Browsing. Registered through Registrar of Domain Names REG.RU LLC on December 25, 2025, id-potok.cash resolved to IP address 172.67.189.22, hosted on Cloudflare’s network (AS13335) in the US. No SSL certificate was present, and nameservers were saanvi.ns.cloudflare.com and wilson.ns.cloudflare.com.

Users who may have interacted with id-potok.cash should immediately change any credentials entered on the site, particularly if reused across other platforms. Enabling two-factor authentication on all accounts is strongly advised to mitigate potential fraud. Victims should monitor financial and login activity for unauthorized access. The domain can be reported to local cybercrime units or platforms like Google Safe Browsing, PhishTank, or the registrar REG.RU for further action.