base[.]whcloud[.]ru

base.whcloud.ru is an active phishing domain that currently shows no detections on VirusTotal, highlighting its recent emergence. This domain, which displays a page titled 'Вход в систему', is hosted on IP address 92.53.96.29. The lack of detections underscores its freshness, as it exploits the typical 24-72 hour gap before antivirus databases update.

The domain's registration details remain elusive, with the registrar listed as REGISTRAR_NOT_FOUND. This anonymity can be a tactic used by threat actors to delay identification and takedown efforts. PhishDestroy's early detection pipeline identifies such threats in the critical window before they appear on broader security radars, allowing for preemptive measures.

The presence of a login page suggests an attempt to harvest user credentials. This type of phishing operation can be particularly damaging, as it often targets unsuspecting users who may not yet be aware of the threat. By capturing these domains early, PhishDestroy provides an opportunity to mitigate potential harm before the domain becomes widely recognized by security vendors.