runescapearts[.]forums[.]events[.]quitting[.]giveaway[.]gul[.]org-fm-678-223-176-122345492-182-342[.]ru

This domain, runescapearts.forums.events.quitting.giveaway.gul.org-fm-678-223-176-122345492-182-342.ru, is identified as a generic phishing threat targeting users of the massively multiplayer online role-playing game RuneScape. Analysis indicates the domain was designed to mimic legitimate RuneScape community forums or event pages, specifically leveraging the theme of a 'quitting giveaway' to lure victims into disclosing account credentials or financial information. The structure of the domain, incorporating terms like 'forums,' 'events,' and 'giveaway,' suggests an attempt to exploit user trust in community-driven content and in-game rewards. No specific drainer kit or malware family has been conclusively linked to this domain at this time, though the tactics align with common phishing campaigns targeting gaming communities. Infrastructure analysis reveals several critical technical indicators. The domain was registered on March 28, 2026, through REGRU-RU, a registrar frequently associated with malicious activity. It resolves to the IP address 185.82.200.115, which has been observed in prior phishing campaigns. The domain is flagged by 19 out of 95 security vendors on VirusTotal, indicating a high level of consensus regarding its malicious nature. Additionally, it appears on two security blocklists and is actively blocked by multiple threat intelligence feeds. The domain employs a Let's Encrypt SSL certificate, a tactic often used by threat actors to create a false sense of security for potential victims. Google Safe Browsing (GSB) status is not explicitly provided, but the domain's presence on multiple blocklists suggests it would likely be flagged. As of the latest assessment, the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure supporting this campaign may remain active, and similar domains could emerge using comparable naming conventions or hosting patterns. Users who interacted with this domain are advised to immediately reset their RuneScape account credentials and enable multi-factor authentication. Organizations should update their blocklists to include the domain and its resolving IP address, 185.82.200.115, to prevent future access. Given the elevated risk level and the domain's association with credential theft, continued monitoring of related infrastructure is recommended to mitigate potential follow-up attacks or rebranding efforts by the same threat actors.