pnz[.]royal-change[.]ru

This domain, pnz.royal-change.ru, operates as a credential theft site designed to harvest sensitive user information under the guise of a legitimate gold purchasing service. Analysis of the page title, "Скупка золота дорого в Пензе - выгодно продать золото по высокой цене | Royal Change," indicates an attempt to impersonate a trusted local brand, luring victims into submitting personal and financial details through fraudulent forms or account login prompts. The site specifically targets Russian-speaking users in Penza, exploiting trust in regional business names to facilitate data exfiltration. Infrastructure analysis reveals multiple indicators of malicious activity. The domain was registered on April 03, 2020, through REGRU-RU, a registrar frequently associated with fraudulent sites. It resolves to the IP address 185.22.234.174 and employs an SSL certificate issued by Let's Encrypt, a common tactic to appear legitimate. Security vendors on VirusTotal flagged the domain at a rate of 3/95, while it appears on at least one security blocklist. Detected technologies include Nginx as the web server and Yandex.Metrika for analytics, further suggesting an organized effort to mimic authentic business operations. Users who visited pnz.royal-change.ru should take immediate action to mitigate potential risks. If any credentials, financial information, or personal data were entered on the site, affected individuals must change passwords for all associated accounts, particularly those linked to banking or email services. Enable multi-factor authentication where available to add an additional security layer. Monitor financial statements for unauthorized transactions and consider placing a fraud alert with credit bureaus. Given the domain's current offline status, users should remain vigilant for similar scams impersonating local businesses or financial services.