getyacdn[.]ru

The domain getyacdn.ru has been identified as a brand impersonation threat, specifically targeting Yandex users. The page title, 'Скачать удобный браузер и полезные сервисы от Яндекса в едином пакете,' suggests an attempt to deceive users into downloading malicious software or providing sensitive information under the guise of legitimate Yandex services.

Analysis indicates that getyacdn.ru has been flagged by 10 out of 95 security vendors on VirusTotal, indicating a moderate level of detection. The domain is registered with Let's Encrypt and resolves to the IP address 35.228.96.114, which is located in Finland and is part of the AS396982 Google LLC network. The domain appears on one security blocklist and has been taken offline, suggesting that it was likely used for a short-lived campaign. The creation date of the domain is not specified, but infrastructure analysis reveals the use of a Let's Encrypt SSL certificate, which is commonly associated with quickly set up and disposable phishing infrastructure.

Currently, the domain is offline, reducing the immediate risk to potential victims. However, the domain's previous activity and its presence on a security blocklist indicate that it was involved in a phishing campaign. Users are advised to exercise caution when encountering similar domain names and to verify the authenticity of Yandex services through official channels. Security teams should monitor for any reactivation of the domain and continue to educate users on the signs of brand impersonation attacks.