denro13edu[.]com

This domain is flagged as a high-risk phishing infrastructure impersonating an investment education platform. Analysis indicates the site presents itself as a "Рациональный инвестор — мини-курс" (Rational Investor Mini-Course), likely targeting Russian-speaking users with fraudulent financial training offers. The specific threat type involves brand impersonation, where attackers mimic legitimate investment courses to harvest personal data, credentials, or payment information under false pretenses. Infrastructure analysis reveals the domain was registered on May 30, 2026, through Name.com, Inc., an unusual future date suggesting potential domain spoofing or registry manipulation. It resolves to IP address 18.208.88.157, hosted on Amazon.com, Inc. (AS16509) infrastructure in Germany. The site employs a Let's Encrypt SSL certificate (YE1), providing a false sense of security. VirusTotal reports 1/95 security vendors flagging this domain, while PhishDestroy has blocked it, and it appears on one additional security blocklist. The page title and content are fully localized in Russian, indicating a targeted campaign. Mitigation steps for this threat type include immediate blocking of the domain and IP at network perimeters, particularly for organizations with Russian-speaking users or financial sector exposure. Security teams should monitor for credential submissions or payment redirects, as these are common secondary payloads in fake course schemes. End-user education should emphasize verifying investment course legitimacy through official provider channels, avoiding unsolicited financial offers, and scrutinizing domain registration dates (e.g., future-dated domains). Incident responders should preserve SSL certificates, IP logs, and page snapshots for forensic analysis, as these may link to broader fraud networks.