tarkov1[.]com

This domain is flagged as an elevated-risk phishing site targeting players of the online game Escape from Tarkov. Analysis indicates tarkov1.com presents itself as an official in-game reward redemption portal, luring victims with promises of free items in exchange for entering legitimate game codes. The specific threat involves credential harvesting and potential account takeovers, as users may unknowingly submit valid reward codes or login credentials to unauthorized third parties. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain resolves to IP address 186.2.171.13 and was registered through NiceNIC International Group Co., Limited on December 24, 2025. Security vendors on VirusTotal flagged tarkov1.com with 5 detections out of 95 engines, while the domain appears on at least 1 security blocklist. AlienVault OTX records show the domain in 3 threat intelligence pulses, suggesting active tracking by security researchers. The site used a Let's Encrypt SSL certificate (R12) to create a false sense of legitimacy, though this is a common tactic among phishing operations. Mitigation requires immediate action from both individual users and security teams. Players should verify all reward redemption pages through official game channels only, never entering codes on third-party sites. Organizations should block the domain and IP address 186.2.171.13 at network perimeter devices. Security teams are advised to check logs for connections to this IP and domain, particularly from gaming-related subnets. Given the domain's creation date being in the future (December 2025), this appears to be either a typo-squatting attempt or an error in registration records, either of which increases suspicion. Users who may have interacted with the site should immediately change their game account credentials and enable multi-factor authentication where available.