voronezh[.]royal-change[.]ru

The domain voronezh.royal-change.ru is identified as a brand impersonation threat specifically targeting Google. Currently, the domain is offline, but prior activity suggests malicious intent to deceive users by mimicking a legitimate brand. Analysis indicates this domain was actively used to mislead visitors into believing they were interacting with a trusted service, despite having no affiliation with Google. Infrastructure analysis reveals the domain was created on April 03, 2020, and registered through REGRU-RU. It resolves to the IP address 185.22.234.174 and employs technologies such as Nginx and Yandex.Metrika. Security assessments show the domain is flagged by 3 of 95 VirusTotal vendors and appears on one security blocklist. The Gridinsoft trust score for this domain is 0 out of 100, further indicating its malicious nature. The SSL certificate is issued by Let's Encrypt, a common practice among both legitimate and malicious sites to encrypt traffic. As of the latest verification, voronezh.royal-change.ru has been taken offline. However, users and organizations are advised to remain vigilant. Blocklist integration is recommended to prevent potential future access attempts. Network administrators should monitor for connections to the associated IP address 185.22.234.174 and investigate any residual traffic. If this domain was previously accessed, review systems for unauthorized activity or data exposure. Always verify domain authenticity before interacting with unfamiliar sites, particularly those claiming affiliation with well-known brands.