jakpro-ru[.]site

Analysis of the domain jakpro-ru.site, created on 11 May 2026 and registered through Namecheap Inc, indicates that it was used in a generic phishing campaign. The site resolves to the IPv6 address 2a06:fcc0:a::20f, which belongs to the German network operated by AS47447 (23M GmbH). The hosting provider is located in DE. The domain is secured with a Let’s Encrypt certificate issued under the E8 profile, confirming the use of a free TLS service. HTTP requests return a 404 status, suggesting that the malicious landing page has been removed or the site is deliberately taken offline.

The page title that was captured prior to takedown reads “Технический анализ — практический интенсив за 4 выходных”, a Russian‑language phrase translating to “Technical analysis — practical intensive over 4 weekends”, which may have been employed to lure victims interested in financial or technical training. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy filtering service. VirusTotal reports that two out of ninety‑one scanners flagged the domain, providing additional corroboration of malicious intent. Nameserver records point to dns1.registrar-servers.com and dns2.registrar-servers.com, both standard registrar‑level servers, offering no further insight into the attacker’s infrastructure.

Because the site currently returns a 404 response, live content analysis is not possible, and the exact phishing payload or credential‑harvesting mechanisms remain unknown. Defenders should continue to block the IPv6 address 2a06:fcc0:a::20f, add jakpro-ru.site to local deny lists, and monitor for any re‑registration attempts or similar domains registered with the same registrar or ASN. Ongoing observation of the associated IP range within AS47447 is recommended, as the infrastructure may be reused for future campaigns.