fedsfm[.]biz

The domain fedsfm.biz was identified as a generic phishing threat, specifically impersonating the Russian financial monitoring service Rosfinmonitoring (РоÑÑÑинмониÑоÑинг). The site displayed a page titled "ПÑовеÑка валÑÑÑнÑÑ Ð°ÐºÑивов | РоÑÑÑинмониÑоÑинг" ("Verification of Currency Assets"), designed to trick users into providing sensitive financial information. No specific drainer kit was associated, but the site's goal was likely credential theft for financial accounts.

Technical indicators paint a clear picture of malicious intent. VirusTotal flagged the domain with 3 out of 95 security vendors, indicating modest but meaningful detection. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on April 11, 2026, and resolved to IP address 104.21.71.246. It used a Let's Encrypt SSL certificate (type E8), and appeared in at least one security blocklist and one AlienVault OTX pulse. Notably, Google Safe Browsing status was not explicitly reported, but its presence in blocklists suggests it was flagged elsewhere.

As of the current assessment, the domain is offline and has been taken down, reducing immediate risk. However, the registration through a public registrar and use of free SSL indicates low operational cost for attackers, who may quickly register new similar domains. Organizations and individuals should remain vigilant against such brand impersonation, monitor for similar domains, and educate users to verify URLs before entering credentials. Blocking the IP and domain at network level is recommended as a precautionary measure.