medrecord[.]mentosfera[.]ru

This domain, medrecord.mentosfera.ru, is identified as a phishing site designed to mimic a legitimate medical records platform, specifically targeting users through fake login portals under the guise of 'MedRecord Pro.' Analysis indicates the site employs brand impersonation tactics, presenting a fabricated medical protocol interface to deceive victims into entering sensitive credentials. No direct evidence of a cryptocurrency drainer kit or payment interception mechanism was observed, but the presence of Axios suggests potential data exfiltration capabilities to a remote endpoint. Infrastructure analysis reveals the domain resolves to the IP address 80.78.243.49, hosted on an Ubuntu server running Nginx, with Cloudflare and cdnjs integrated into its technology stack. The domain is registered through REGRU-RU, a registrar frequently associated with high-risk domains. VirusTotal detections report 3 out of 95 security vendors flagging the domain as malicious, while it appears on two security blocklists. The domain's Gridinsoft trust score is 0/100, indicating a complete lack of credibility. Google Safe Browsing (GSB) status is not explicitly provided, but the domain's presence on PhishDestroy and OISD blocklists further corroborates its malicious classification. As of the latest assessment, medrecord.mentosfera.ru has been taken offline, likely in response to detection and reporting by security vendors. However, the residual risk remains elevated due to the domain's recent activity and the potential for threat actors to redeploy the infrastructure under a new domain or IP address. Users who may have interacted with the site are advised to immediately revoke any entered credentials, monitor for unauthorized access to linked accounts, and employ multi-factor authentication where available. Organizations should update their security policies to block the domain, its resolved IP, and associated registrar patterns to mitigate future exposure.