investudy[.]kz

This domain, investudy.kz, is identified as an active credential harvesting phishing site designed to deceive users through fraudulent educational service offers. The page title, Бесплатное предобучение (Free Pre-Training), suggests a lure targeting individuals seeking educational opportunities, likely in Kazakhstan given the domain’s .kz TLD and hosting infrastructure. Analysis indicates no direct association with known drainer kits or specific brand impersonation, but the site follows a common phishing pattern of offering free services to harvest login credentials, personal data, or financial information. Infrastructure analysis reveals multiple high-risk technical indicators. The domain resolves to IP address 77.220.207.191, hosted on AS51162 (JSC Kazteleport, a subsidiary of Halyk Bank of Kazakhstan), and was registered through HOSTER.KZ on March 04, 2022. The SSL certificate is issued by Let’s Encrypt (YR2), a common choice for both legitimate and malicious sites due to its free availability. VirusTotal detection shows 3 out of 95 security vendors flagging the domain as malicious, while it appears on one additional security blocklist. The domain is currently not listed on Google Safe Browsing but has been blocked by independent threat intelligence feeds. As of this assessment, investudy.kz remains active and poses a high risk to users. The domain’s infrastructure, combined with its localized targeting and lack of widespread detection, suggests it may evade some automated defenses. Recommended response actions include immediate blocking of the domain and IP at network and endpoint levels, along with user education to recognize phishing lures related to free educational offers. Given the hosting provider’s association with a major Kazakh financial institution, further investigation into potential abuse of legitimate infrastructure is warranted. Users are advised to avoid interacting with the site and to verify educational offers through official channels only.