prostitutki-ufi[.]xyz

PhishDestroy identifies prostitutki-ufi.xyz as a recently activated phishing domain masquerading as a Russian escort service rating platform. The page title in Russian explicitly promises listings starting at 1,000 rubles along with reviews, while the underlying infrastructure and SSL certificate are designed to appear legitimate at first glance. The site was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 20, 2026, which is notably recent given the campaign’s active status. This domain resolves to IP address 80.79.7.28 and currently eludes detection with zero out of 95 VirusTotal engines flagging it. The SSL certificate issued by Let’s Encrypt adds superficial credibility, while the domain’s age and clean detection rate indicate a likely recently deployed trap. At the time of analysis, VirusTotal shows no detections and Google Safe Browsing has not yet blacklisted the domain, leaving it unblocked by major browsers. Historical telemetry suggests this infrastructure may be part of a broader campaign leveraging adult-service lures to harvest payment card data. The threat remains active and under active investigation, with no upstream takedown initiated at this stage. Users interacting with prostitutki-ufi.xyz risk credential theft or financial drain via disguised checkout flows. Immediate defense includes blocking the domain and IP at DNS and network levels, reporting to threat intelligence platforms, and advising users to avoid clicking unsolicited links claiming to offer escort services in Ufa. Remaining risk is assessed as moderate due to low detection coverage and ongoing availability, warranting heightened monitoring for similar newly registered domains leveraging adult-themed lures.