malgobek[.]ru

PhishDestroy identifies malgobek.ru as a generic phishing domain impersonating a cryptocurrency service to harvest user credentials. The domain is likely part of a credential theft campaign targeting crypto investors, leveraging deceptive branding to trick users into entering sensitive login information. No specific drainer kit or obfuscation method has been publicly documented at this stage, but the domain's recent creation and low detection rate suggest a rapidly evolving threat. This domain was flagged on July 09, 2024, and is registered through RU-CENTER-RU. It resolves to IP address 185.111.111.157 and utilizes a Let's Encrypt SSL certificate to appear legitimate. As of the latest scan, VirusTotal shows 0/95 detections, indicating it has not yet been widely flagged by security vendors. Google Safe Browsing (GSB) status remains unverified, and no blocklist counts are publicly available. The domain's generic nature and lack of detections highlight the importance of proactive monitoring and user vigilance. malgobek.ru remains active and under investigation, posing a moderate risk due to its potential to deceive users into submitting credentials. Security teams and users are advised to block the domain at the network level and avoid interacting with it. Immediate reporting to threat intelligence platforms is encouraged to aid in rapid detection and mitigation. Remaining risk is assessed as moderate, contingent on future takedown actions and further intelligence gathering.