kundenserver[.]moy[.]su

Analysis on kundenserver.moy.su shows that the domain resolves to 88.211.243.183, an address allocated to the Netherlands under ASN 7979 owned by Servers.com, Inc. The host serves Nginx and reports a Yandex.Metrika integration, suggesting possible traffic analytics capability. An SSL certificate issued by GlobalSign nv‑sa, chained to the GlobalSign GCC R6 AlphaSSL CA 2023, is present, confirming that TLS negotiation was configured despite the site being offline. HTTP probing returned a 404 status and the page title “410 – Website deleted,” indicating that the content has been removed or the site is intentionally returning a deletion notice. The Gridinsoft trust score is 0 / 100, reflecting an extremely low reputation.

VirusTotal submissions show that five of ninety‑five scanning engines flagged the domain, reinforcing the suspicion of malicious use. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy feed, which categorises it as a social‑media phishing campaign targeting Facebook. No valid nameserver records were returned (NS_NOT_FOUND), limiting further DNS‑based attribution. The registrar entry lists SERVERS‑COM‑AMS3 as the registration point, consistent with the hosting ASN.

Overall, the observable indicators—low trust score, partial VT detections, blocklist presence, TLS certificate, and the “410 – Website deleted” response—support the classification of this domain as a brand‑impersonation phishing vector aimed at Facebook users. Defenders should add the domain and its resolved IP to network‑level deny lists, enforce DNS‑based filtering for the .su TLD, and monitor for any resurgence of the host. Continuous re‑scanning with multi‑engine services is advised to capture any changes in detection status. Because the site is currently offline, threat actors may reactivate it, so periodic verification is recommended.