xamomaxm[.]ru

This domain, xamomaxm.ru, is identified as an active fake verification phishing site designed to harvest user credentials through deceptive login prompts. The page title 'Верификация' (Verification) suggests an attempt to impersonate legitimate authentication processes, likely targeting unsuspecting users who may believe they are accessing a trusted service. Analysis indicates no direct brand impersonation, but the generic verification theme is a common tactic in credential theft campaigns. Infrastructure analysis reveals multiple high-risk indicators. The domain is flagged by 2 of 95 security vendors on VirusTotal, a low but notable detection rate that underscores its malicious nature. It resolves to the IP address 45.10.243.59, hosted under AS57724 (DDOS-GUARD LTD), a network frequently associated with fraudulent activities. The SSL certificate is issued by Let's Encrypt (YR1), a legitimate provider often exploited by threat actors due to its free and automated issuance process. The domain appears on one security blocklist and is actively blocked by PhishDestroy, further confirming its malicious classification. Additional metadata, such as the Russian registrar and hosting location, aligns with patterns observed in phishing campaigns targeting global users. Current status confirms the domain remains active, posing an ongoing threat to individuals who may encounter it through phishing links or malicious advertisements. The risk level is classified as high due to the domain's operational status and its potential to compromise sensitive user data. Immediate mitigation steps are recommended for organizations and end-users: block the domain at the network level, update security filters to include the IP address 45.10.243.59, and educate users on recognizing fake verification prompts. Monitoring for similar domains using the same infrastructure (e.g., AS57724, Let's Encrypt certificates) is advised to preemptively disrupt related threats. Users who may have interacted with the site should reset credentials on any accounts accessed during the encounter and enable multi-factor authentication where available.