formula-champ[.]ru

This domain, formula-champ.ru, is actively flagged as a high-risk credential phishing site targeting users under the guise of an international student technical sports league. Analysis indicates the domain is registered through TW-Cloud (ASN: 9123) and resolves to the IPv6 address 2a03:6f00:6:1::b972:f57b, with a Let's Encrypt SSL certificate in place. The page title, 'formula-champ.ru — Сайт Международной лиги студенческого технического спорта "Формула Мастер"', suggests an attempt to impersonate a legitimate organizational website, though no specific brand or entity is confirmed as the intended target beyond this thematic context. The domain appears on three security blocklists and has been included in 50 threat intelligence pulses on AlienVault OTX, indicating widespread recognition as malicious. Seven of 95 security vendors on VirusTotal have flagged the domain, though the remaining vendors have not yet classified it, leaving some uncertainty regarding its full detection coverage. The domain remains active as of July 12, 2026, with no evidence of takedown or mitigation. Defenders should treat this domain as a confirmed phishing threat. Immediate action includes blocking resolution at the DNS level, adding the domain to web proxy and email gateway denylists, and monitoring for connections to the associated IP address. Given the domain's active status and lack of reputable trust scores, no further validation of its legitimacy is warranted. If internal access logs indicate prior visits, initiate credential reset procedures for affected accounts and review for signs of unauthorized access or data exfiltration.