maharuh[.]com

This domain is flagged for credential theft phishing, targeting individuals seeking employment recruitment services in the UAE. Analysis indicates an elevated risk level due to its deceptive infrastructure and confirmed malicious activity. The site impersonates legitimate labor recruitment offices, using phone numbers and localized content to lure victims into submitting sensitive personal and financial information. Infrastructure analysis reveals multiple high-risk indicators. The domain maharuh.com is registered through NameCheap, Inc., and resolves to the IP address 188.114.96.3. It was created on April 12, 2026, an anomalous future date suggesting potential domain spoofing or registration manipulation. Security vendors on VirusTotal flagged the domain as malicious, with 7 out of 95 engines detecting it. Trust scores from Scamadviser and Gridinsoft are critically low at 46/100 and 0/100, respectively. The domain appears on at least one security blocklist and is currently offline, though prior activity remains a concern. Technologies detected include WordPress, MySQL, PHP, and Cloudflare, which may be leveraged to obfuscate malicious behavior or exfiltrate data. To mitigate risks associated with credential theft phishing, users should avoid interacting with this domain or any associated communications. If personal or financial details were submitted, immediate steps should include resetting passwords, enabling multi-factor authentication on all accounts, and monitoring for unauthorized transactions. Organizations should block the domain and its resolving IP (188.114.96.3) at the network level to prevent access. Additionally, reporting the domain to relevant cybersecurity authorities or fraud prevention platforms can aid in broader threat disruption. Future vigilance is advised, particularly for domains mimicking recruitment services or using localized phone numbers to appear legitimate.