lenta24[.]biz

On 24 July 2026 security analysts examined the domain lenta24.biz. Registration records show the domain was created on 21 February 2026 via NiceNIC International Group Co., Limited, and it is delegated to Cloudflare nameservers (zac.ns.cloudflare.com, sofia.ns.cloudflare.com). DNS resolution points to the Cloudflare edge address 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The site serves HTTPS with a certificate issued by Google Trust Services and anchored to the WE1 root, confirming a valid TLS chain.

An HTTP request receives a 302 temporary redirect; the only page title captured is “Все товары - Лента”, meaning “All products – Lenta”. Front‑end analysis reveals the presence of Highcharts, Slick, Select2, jQuery, and Cloudflare’s HTTP/3 support, indicating a modern web stack. Reputation signals are poor: Gridinsoft assigns a trust score of 0 out of 100, a single public blocklist now lists the domain, and PhishDestroy categorises it as an active generic phishing site. VirusTotal flagged the domain with one positive detection out of ninety‑five scanners.

No additional intelligence on the specific phishing target or payload is available, and the content has not been publicly dissected. The combination of a fresh registration, active redirect, valid SSL, and low trust scores points to a newly launched phishing campaign likely aimed at Russian‑speaking users, leveraging the “Lenta” branding in the title. Defensive recommendations include immediate network‑level blocking of lenta24.biz and its resolved IP, inclusion of the domain and IP in URL and DNS filtering policies, and continuous re‑scanning to capture any changes in malicious behavior. Organizations should also monitor outbound traffic for connections to Cloudflare edge nodes that may be used as a proxy for the phishing host, and consider sinkholing the domain to disrupt the campaign.