electrum[.]ru

Analysis of electrum.ru indicates active malicious activity targeting the Bitcoin brand. The domain was registered on February 21, 2026 through the Russian registrar REGRU-RU and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a page title of "Electrum – Bitcoin кошелек с открытым исходным кодом", suggesting an attempt to mimic the legitimate Electrum wallet. The TLS certificate is issued by Google Trust Services under the WE1 designation, providing a valid HTTPS connection but offering no guarantee of legitimacy. HTTP responses return a 200 status code, indicating the server is actively serving content.

The infrastructure runs WordPress with MySQL and PHP, and includes common plugins such as All in One SEO, Yandex.Metrika, and jQuery libraries; HSTS is also enforced. Security telemetry shows the domain appears on three blocklists—PhishDestroy, MetaMask, and SEAL—and is listed as a crypto‑scam impersonating Bitcoin. VirusTotal reports that 2 of 95 scanning engines flag the domain, reinforcing the suspicion. Gridinsoft assigns a trust score of 0 out of 100, reflecting a highly untrusted reputation.

While the page content has not been directly examined, the combination of brand‑specific page title, crypto‑scam classification, low trust scores, and presence on multiple blocklists provides strong evidence of a credential‑harvesting or fund‑diversion operation. Defenders should block the domain at network perimeter and update endpoint and browser protection lists to include the identified IP and hostname. Continuous monitoring of the associated IP range and Cloudflare‑hosted services is recommended, as threat actors often shift infrastructure within the same provider. Organizations using Electrum or handling Bitcoin assets should alert users to verify URLs carefully and consider employing MFA and hardware wallets to mitigate credential compromise.