rus979[.]it

The domain rus979.it has been identified as a high-risk generic phishing threat. Currently, it does not impersonate any known brand, but the content observed on the website indicates an intent to deceive users. The absence of an SSL certificate further suggests that the site may be designed to harvest sensitive information without the use of secure connections.

Technical indicators reveal that rus979.it has a VirusTotal detection score of 2/95, highlighting a low but concerning visibility among security vendors. The domain was registered through 1 Api GmbH and resolves to the IP address 172.67.193.154, which is located in the United States and operated under AS13335, associated with Cloudflare, Inc. The domain was created on January 12, 2025, and is currently listed on one security blocklist, indicating that it has been flagged for malicious activity. Additionally, it has been blocked by the PhishDestroy service, which further corroborates its phishing activities.

As of the present analysis, rus979.it remains active and poses a significant risk to users. The presence of this domain on a security blocklist, in conjunction with its low VirusTotal score, suggests that while it may not be widely recognized yet, it is still capable of conducting phishing operations. Users are advised to exercise caution and avoid any interactions with this domain. It is recommended to implement robust security measures, including the use of updated anti-phishing solutions and user education to recognize potential phishing attempts.