consto[.]ru

Analysis of the domain consto.ru, observed as offline as of the report date (July 24, 2026), indicates it was employed in a generic phishing campaign. The domain was registered on September 30, 2025 through the registrar REGRU‑RU and uses the authoritative name servers ns1.regerey.com and ns2.regerey.com. DNS resolution points to the IP address 198.18.1.158, which is the sole host associated with the observed activity. No TLS certificate is present, meaning all HTTP traffic would be unencrypted. Malware and phishing detection services have flagged the domain; one of ninety‑five VirusTotal scanners reported it as malicious, and it appears on a single external blocklist.

Gridinsoft assigns the domain a trust score of zero out of one hundred, reinforcing the malicious assessment. PhishDestroy has confirmed the domain as blocked, and the page title returned by the server is the literal string “consto.ru”. The domain age at the time of detection was less than one year, a pattern commonly seen with phishing operators that prefer freshly registered zones to evade reputation‑based filters. The limited detection footprint—only one blocklist entry and a single vendor flag—suggests that the malicious infrastructure may have been short‑lived or that the site was taken down quickly after deployment.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms, as no further content analysis or sandbox execution data are available. Defenders should continue to block the domain at network perimeter devices, update DNS filtering lists with the observed IP and name server entries, and monitor for any resurgence of the same infrastructure under new domains. Incident response teams should treat any credentials submitted to consto.ru as compromised and advise affected users to reset passwords and review account activity. Ongoing intelligence collection is recommended to determine whether the IP address is reused in related campaigns.