veronacake[.]ru

The domain veronacake.ru has been identified as a high-risk phishing infrastructure designed to harvest credentials by impersonating a municipal-level administrative portal, specifically targeting entities associated with the identifier 'kra46'. Analysis indicates this domain is engineered for credential theft, leveraging social engineering tactics to deceive users into submitting sensitive login information. The page title, 'kra46 - воплощает муниципалитет СС уровня', suggests a localized focus, likely aimed at Russian-speaking users within a specific municipal or regional context. Infrastructure analysis reveals the domain was registered on December 24, 2024, through REGRU-RU, a registrar frequently associated with malicious activity. It resolves to the IP address 91.236.116.20, hosted on AS42237 (w1n ltd) in Sweden, a network segment previously linked to phishing and fraudulent operations. The domain is flagged by 14 of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as phishing. It appears on one security blocklist and employs a Let's Encrypt SSL certificate (serial number E7), a common tactic to lend superficial legitimacy to fraudulent sites. The domain's current status is offline, though historical resolution and certificate data remain active indicators. Given the domain's recent creation, targeted impersonation, and technical indicators, organizations should treat veronacake.ru as a confirmed malicious entity. Immediate actions include blocking the domain and its resolving IP (91.236.116.20) at the network perimeter, updating endpoint protection rules to detect associated SSL certificates, and alerting users to the specific threat posed by municipal portal-themed phishing. Security teams are advised to monitor for related domains registered through REGRU-RU or resolving to AS42237, as these may indicate further campaign expansion. Historical certificate data (E7) should be incorporated into threat intelligence feeds for retrospective detection.