kosterfest[.]ru

Analysis performed on 24 July 2026 indicates that the domain kosterfest.ru is actively hosting a phishing campaign. The site lacks an SSL certificate, serving content over plain HTTP, which aligns with typical low‑cost phishing infrastructure. The domain was registered on 19 June 2025 through the registrar TIMEWEB‑RU and is delegated to Cloudflare nameservers carl.ns.cloudflare.com and colette.ns.cloudflare.com. DNS resolution points to the IP address 198.18.1.60, an address commonly used in internal testing ranges but observed in malicious hosting contexts. The page title returned from the root URL is “8 июня • Костёр фест @ Амфитеатр под небом”, providing no indication of legitimate business activity and suggesting the page is either a placeholder or part of a social‑engineering lure.

Reputation services flag the domain as malicious: seven out of ninety‑five VirusTotal scanners raise detections, Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one external blocklist. The phishing‑specific blocklist PhishDestroy has already listed the domain, confirming its classification as a phishing site. No SSL/TLS certificate is present, which prevents certificate‑based trust checks. The current operational status is marked as active, meaning the site remains reachable. Evidence is limited to the metadata above; the actual payload, target brand, or credential‑capture mechanism has not been observed.

Consequently, uncertainty remains regarding the specific phishing template and the victim demographic. Defenders should block DNS resolution for kosterfest.ru, add the IP 198.18.1.60 to network‑level deny lists, and ensure the domain is included in web‑filter and email‑gateway blocklists. Continuous monitoring of VirusTotal, Gridinsoft, and other sandbox feeds is advised to capture any changes in detection ratios. Organizations should also verify that any outbound connections to the listed IP are logged and investigated.