tigar77[.]com

This domain is flagged as a credential harvesting phishing site targeting Russian-speaking users under the guise of an online retail store. The threat level is classified as elevated due to confirmed malicious activity and infrastructure characteristics commonly associated with phishing operations. Analysis reveals multiple technical indicators supporting this classification. The domain tigar77.com is detected by 7 out of 95 security vendors on VirusTotal, resolves to IP address 172.67.203.144, and was registered through NiceNIC International Group Co., Limited on February 21, 2026. It appears on one security blocklist and has been assigned a trust score of 0/100 by Gridinsoft. Infrastructure analysis shows the use of Cloudflare services (including Browser Insights and HTTP/3) and was previously blocked by PhishDestroy. The page title "Тигра Стиль — Магазин Тигра" suggests targeting of Russian-language users. Mitigation for this specific threat type requires immediate action from network defenders. Organizations should implement DNS-level blocking for tigar77.com and its associated IP 172.67.203.144. Security teams should review web proxy logs for connections to this domain, particularly from endpoints that handle sensitive credentials. Endpoint protection should be configured to detect and prevent access to newly registered domains with similar characteristics (registration age < 30 days, Cloudflare-protected, retail-themed). User awareness training should emphasize verification of Cyrillic-language retail sites, especially those using generic domain names with brand references. Monitoring should be established for domains containing "tigar" or similar strings registered through NiceNIC.