panfilova2[.]msk[.]ru

Analysis of panfilova2.msk.ru indicates that the domain is currently active and is being used in a generic phishing campaign. The authoritative name servers are ns1.rustest.net and ns2.rustest.net, which are commonly observed in other malicious infrastructures. DNS resolution points to the IPv4 address 149.154.70.141; no additional A or AAAA records are publicly listed. The domain has been listed on a single security blocklist and is actively blocked by the PhishDestroy feed, confirming that at least one threat‑intelligence source has identified malicious use. VirusTotal records show that the domain was submitted to 91 scanning engines, none of which returned a positive detection at the time of the scan.

The absence of detections should not be interpreted as a clearance, as many phishing sites employ techniques that evade static analysis. No publicly available SSL certificate information, HTTP response codes, or page‑title metadata have been disclosed, limiting the ability to assess the surface‑level behavior of the hosted content. Likewise, there is no evidence of a specific brand impersonated, a known phishing kit, or a targeted sector beyond the generic classification. The lack of such details means that the exact lure and credential‑capture mechanisms remain uncertain. Defenders should treat the domain as hostile.

Immediate mitigation steps include adding 149.154.70.141 to network‑level deny lists, enforcing DNS sink‑holing for panfilova2.msk.ru, and ensuring that email gateways block any messages containing URLs that resolve to this host. Continuous monitoring of the name servers and the IP address for changes is recommended, as the operators may pivot to new infrastructure. Re‑scanning the domain with dynamic analysis tools and requesting updated VirusTotal reports will help capture any future detection signatures.