biomap[.]ru

This domain, biomap.ru, operates as a credential harvesting platform impersonating Telegram login interfaces under the guise of a medical equipment manufacturer. Analysis indicates the site presents a fabricated corporate identity for Biomap, claiming to produce vascular simulation models for medical training, while simultaneously hosting phishing pages designed to capture Telegram account credentials. The deception targets Russian-speaking users through localized content and domain registration infrastructure. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain resolves to 37.140.192.179 within AS197695, registered through REGRU-RU, a registrar frequently associated with fraudulent domains. Security vendors have flagged the domain in 10 out of 95 VirusTotal engines, while two independent blocklists have listed it for phishing activity. The site employs a Let's Encrypt SSL certificate (R12) to create a false sense of legitimacy, a common tactic in credential theft campaigns. Users who have visited biomap.ru should immediately revoke any entered credentials through Telegram's account recovery options. System administrators should block the domain and its resolving IP address (37.140.192.179) at network perimeter devices. Affected parties should monitor connected accounts for unauthorized access attempts and consider implementing multi-factor authentication where available. The domain's current offline status does not preclude future reactivation through the same infrastructure.