apostil-russia[.]com

The domain apostil-russia.com is currently flagged as an active credential theft phishing site. Analysis indicates the infrastructure is designed to harvest login credentials, likely targeting individuals seeking authentication services or official documentation. The domain remains operational, with no evidence of takedown or mitigation efforts as of the latest assessment. Infrastructure analysis reveals the domain was registered on June 22, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 89.127.208.84, which has been linked to other malicious activities in recent months. The domain holds a Gridinsoft trust score of 0/100, reflecting a complete lack of legitimacy. VirusTotal detection rates are minimal, with only 1 of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Let's Encrypt, a common tactic among threat actors to lend a false sense of security to visitors. Current status confirms the domain remains active and accessible, posing an ongoing risk to users. Organizations and individuals are advised to block the domain and its associated IP at the network level. Endpoint protection solutions should be updated to include this domain in their blocklists, and users should be educated on recognizing phishing attempts, particularly those impersonating official documentation services. Monitoring for related domains registered through the same registrar or resolving to the same IP is recommended to preemptively mitigate similar threats.