banditcmp[.]com

The domain banditcmp.com was registered on March 5, 2026 through NiceNIC International Group Co., Limited. It resolves to 104.21.54.121, an address owned by AS13335 Cloudflare, Inc., and is served behind Cloudflare’s DNS (damien.ns.cloudflare.com, rita.ns.cloudflare.com). The site presents a valid Let’s Encrypt certificate (E8) and returns HTTP 200 responses, indicating a fully functional web server with standard TLS configuration for Cloudflare‑protected sites.

The landing page is titled “BANDIT.CAMP - Официальная Rust Рулетка, 10 Rust Items”, a Russian‑language heading that mimics a gambling‑style offering of in‑game items. Front‑end inspection reveals a Vue.js application augmented by Cloudflare Browser Insights and HTTP/3, confirming a modern web stack. No overt malware payloads are delivered, but the thematic presentation aligns with credential‑harvesting lures that impersonate legitimate gaming services.

Threat intelligence classifies the domain as high‑risk generic_phishing. PhishDestroy has already blocked the site, and Gridinsoft assigns a trust score of 0 out of 100. VirusTotal records four of ninety‑five scanners flagging the domain, reinforcing the suspicion of malicious intent. The recent creation date, low trust rating, and alignment with known phishing patterns suggest the operator is attempting to collect user credentials, likely targeting players of the Rust ecosystem.

Defenders should block DNS resolution for banditcmp.com at the network perimeter and monitor outbound connections to 104.21.54.121. Email security solutions should flag messages that reference the banditcmp.com URL or contain similar Russian‑language gambling terminology. Users must be warned against entering credentials on the site, and any attempted logins should be reported to the presumed service provider. Continuous re‑evaluation is advised, as the attacker may modify the landing page or shift hosting while retaining the same domain.