relaynickelacount[.]t[.]mydomain[.]zone

The domain relaynickelacount.t.mydomain.zone was observed hosting a page titled “Аккаунт заблокирован”. The site was listed on a single security blocklist and was subsequently taken offline, as confirmed by the current status flag. No TLS certificate was presented during connection attempts, indicating that the service operated without encryption. DNS resolution points to the IPv4 address 195.58.48.26, which belongs to the Autonomous System AS51659 owned by LLC Baxet in the Russian Federation.

The authoritative name servers are ns1.justhost.ru and ns2.justhost.ru, both associated with the JustHost hosting provider. Registration information shows the domain was provisioned through BG-NETWORK, also identified with ASN 51659. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis recorded 13 detections out of 95 scanned security vendors, reinforcing the suspicion of phishing activity.

The blocklist entry and the PhishDestroy tag further corroborate the classification as a generic phishing campaign. Because the site is no longer reachable, direct content inspection could not be performed, leaving the exact payload and credential‑harvesting mechanisms unknown. Defenders should continue to block the domain and the associated IP address at perimeter defenses, monitor for any resurrection of the host or reuse of the same nameservers, and consider adding the IP to threat‑intelligence feeds. Ongoing observation of ASN 51659 traffic may reveal additional malicious infrastructure tied to this campaign.