gryzha[.]kz

This domain, gryzha.kz, is currently flagged as an active phishing site targeting individuals seeking medical treatment for joint pain in Almaty. Analysis indicates the page presents itself as a legitimate service offering rapid relief through a method called 'AManat Med,' with promotional discounts on diagnostic procedures. The domain was registered on October 29, 2024, and remains operational as of July 12, 2026, resolving to the IP address 213.130.74.91. Infrastructure analysis reveals the use of a Let's Encrypt SSL certificate, which provides basic encryption but does not validate the legitimacy of the site's content or operators. The domain appears on two security blocklists, including PhishDestroy and BLP-Malware, and has been documented in 14 threat intelligence pulses within AlienVault OTX. Additionally, five out of 95 security vendors on VirusTotal have flagged gryzha.kz as malicious, further corroborating its classification as a high-risk phishing site. The presence of tracking technologies such as Google Tag Manager, Google Analytics, and Facebook Pixel suggests an attempt to monitor user interactions, which is consistent with fraudulent schemes designed to optimize conversion rates or harvest personal data. What remains uncertain is the exact nature of the data being collected or the ultimate objective of the operators. The site may be designed to solicit payments for non-existent services, capture sensitive personal or financial information, or distribute malware under the guise of medical consultations. The use of Tilda, a website builder platform, indicates a low-effort deployment, which is typical of opportunistic phishing campaigns. Defenders should treat this domain as compromised and implement blocking measures at the network and endpoint levels. Organizations are advised to monitor for any indicators of compromise associated with this IP or domain, particularly in regions where Russian-language phishing campaigns are prevalent.