knab5cc[.]ru

This domain, knab5cc.ru, is identified as a generic phishing site impersonating the World of Warcraft gaming platform. The page title, 'GPLP WoW — Próximamente,' suggests an attempt to mimic legitimate World of Warcraft login or promotional pages, likely targeting users with fake login portals or credential harvesting schemes. No specific drainer kit signatures were observed in initial scans, but the domain exhibits characteristics consistent with brand impersonation tactics commonly used in phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 54.38.26.132, hosted on infrastructure previously associated with malicious activity. It was registered on March 28, 2026, through the registrar R01-RU, a provider frequently utilized in phishing operations. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The domain's SSL certificate is issued by Let's Encrypt (serial number E7), a common certificate authority exploited in phishing sites due to its free and automated issuance process. Google Safe Browsing does not currently list the domain, though this may reflect a lag in detection rather than benign status. As of the latest assessment, knab5cc.ru has been taken offline, likely in response to detection by threat intelligence platforms, including its inclusion in one AlienVault OTX pulse. While the domain is no longer active, residual risk persists due to the potential for re-registration or migration to alternative infrastructure. Users who interacted with the site prior to its takedown should assume credential exposure and initiate password resets on associated accounts. Organizations are advised to monitor for related domains registered under the same registrar or resolving to the identified IP address, as threat actors often reuse infrastructure across campaigns.