ru[.]virt-chat[.]top

Analysis of ru.virt-chat.top shows a high‑risk, active phishing infrastructure first registered on 27 October 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain resolves to IP 84.201.25.167, hosted in Germany under ASN 214036 (Ultahost, Inc.) and served by Nginx with a Let’s Encrypt R13 certificate, indicating a valid TLS handshake. HTTP requests return status 200, and the page title captured is "Виртуальный секс чат без регистрации – воплотите все свои фантазии на сайте virt-chat.com," suggesting the site is positioned as a virtual sex chat service that may be attempting to mislead visitors into believing it is affiliated with virt‑chat.com. VirusTotal records a single positive detection out of 95 scanned security vendors, and Gridinsoft assigns a trust score of 0 / 100, reflecting a strong malicious assessment.

The domain appears on one security blocklist and has been explicitly blocked by PhishDestroy, reinforcing its classification as a phishing vector. DNS is delegated to Hetzner’s infrastructure (helium.ns.hetzner.de, hydrogen.ns.hetzner.com, oxygen.ns.hetzner.com). Google Analytics is detected, indicating possible traffic tracking for monetisation or credential harvesting.

While the exact payload or credential‑stealing mechanisms have not been publicly disclosed, the combination of a low‑trust score, vendor detection, blocklist presence, and the adult‑oriented page title points to a likely credential‑phishing or fraud campaign targeting users seeking adult chat services. Defenders should add ru.virt-chat.top to network blocklists, monitor traffic to its hosting IP, and enforce URL filtering for the observed page title pattern. Continuous re‑scanning of the domain is advised to capture any evolving malicious components.