goodmodslab[.]ru

The domain goodmodslab.ru is currently classified as a high‑risk generic phishing indicator. It was registered on 21 February 2026 and has been observed serving a page titled “GoodModsLab”. The site returns an HTTP 302 redirect, a pattern often used to forward victims to malicious credential‑capture hosts.

Infrastructure analysis shows the domain resolves to 81.200.145.91, an address advertised under AS9123 JSC TIMEWEB and geolocated to Russia. Authoritative name servers are ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, and ns4.timeweb.org. Mail exchangers mx1.timeweb.ru and mx2.timeweb.ru are both configured with priority 10, indicating standard hosting services. The TLS certificate presented is issued by the R3 intermediate, a common public‑trusted chain.

Detection telemetry indicates the domain appears on a single security blocklist, PhishDestroy, and has been flagged by one of ninety‑five VirusTotal scanners. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The domain remains active as of 12 July 2026, and no additional intelligence sources have reported mitigation or takedown.

While the observable infrastructure points to a standard hosting provider, the specific phishing kit or credential‑harvesting page content has not been publicly released. No brand or login page has been identified, and the redirect target remains unconfirmed, leaving the exact victim lure ambiguous.

Defenders should treat goodmodslab.ru as a malicious phishing vector. Immediate actions include adding the domain to outbound and inbound filtering rules, monitoring DNS queries for the associated IP and name server set, and reviewing any internal logs for HTTP 302 responses tied to this host. Continuous threat‑intel feeds should be consulted for future blocklist additions.