mapoffline[.]ru

Analysis of mapoffline.ru confirms its classification as an active credential phishing domain targeting Russian-speaking users. The site presents itself as a free AI service, as indicated by the page title 'Бесплатный AI онлайн: мощная нейросеть для общения, текста, кода и идей - Бесплатный Ai,' which suggests an attempt to lure victims into submitting login credentials or other sensitive information under the guise of accessing AI tools. Infrastructure analysis reveals the domain resolves to 92.53.96.200, an IP address assigned to AS9123 (JSC 'TIMEWEB') in Russia. The domain utilizes nameservers ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, and ns4.timeweb.org, consistent with hosting services provided by the same organization. The domain is flagged by one security blocklist and has been detected by 5 of 91 security vendors on VirusTotal, indicating moderate but not universal recognition of its malicious nature. A Gridinsoft trust score of 0/100 further supports its classification as high-risk. The site currently returns an HTTP 301 redirect, which may indicate an attempt to evade detection or direct users to a secondary malicious endpoint. MX records point to mx1.timeweb.ru and mx2.timeweb.ru, suggesting the infrastructure may also be used for email-based phishing campaigns. While the exact content and functionality of the phishing page remain unconfirmed, the combination of AI-themed branding, credential phishing classification, and technical indicators strongly suggests this domain is actively harvesting user data. Defenders should prioritize blocking the domain and its associated IP address, monitoring for related email activity, and investigating potential connections to broader phishing campaigns leveraging similar infrastructure.