rustore-242424[.]sbs

This domain is flagged as a high-risk generic phishing threat targeting cryptocurrency users through fake storefront or wallet-draining schemes. Analysis indicates the domain is designed to mimic legitimate crypto platforms, likely to harvest credentials or execute unauthorized transactions. The specific threat type involves impersonation of digital asset services, a common tactic in crypto-related fraud. Infrastructure analysis reveals the domain rustore-242424.sbs was registered on March 25, 2026, through Global Domain Group LLC, a registrar frequently associated with malicious domains. It resolves to the IP address 178.16.54.73, hosted in the Netherlands under Omegatech LTD, an infrastructure provider linked to prior phishing campaigns. The domain appears on three security blocklists, including entries from PhishDestroy, MetaMask, and SEAL. VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious, with no valid SSL certificate present, increasing the likelihood of interception or tampering. The domain is currently offline, but its historical activity and registration details suggest persistent malicious intent. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address (178.16.54.73) at the network perimeter. Users who may have interacted with the domain should revoke any connected wallet permissions, rotate credentials for crypto exchanges or wallets, and monitor transaction histories for unauthorized activity. Organizations should update endpoint protection rules to detect and prevent access to domains registered through high-risk registrars like Global Domain Group LLC. Additionally, security teams should review logs for connections to the IP address and domain, particularly in environments where cryptocurrency transactions are common.