sex-ussurijsk[.]xyz

PhishDestroy identifies active romance-scam phishing infrastructure at sex-ussurijsk.xyz, classified as a high-risk human-driven lure targeting emotional manipulation and financial extraction.

This domain was flagged on 4/24/2026 via NICENIC INTERNATIONAL GROUP CO., LIMITED registration and immediately resolved to IPv4 80.79.7.15. VirusTotal analysis returned 3/95 detections, indicating no antivirus vendor has yet added signatures for this campaign. The domain acquired a Let’s Encrypt SSL certificate, leveraging TLS to cloak traffic as legitimate. No current presence on major blocklists (e.g., PhishTank, OpenPhish) suggests early-stage deployment and minimal historical abuse reporting. Domain age remains under 48 hours, limiting reputation scoring and delaying containment actions.

To neutralize risk, block sex-ussurijsk.xyz at DNS and firewall levels using IoC 80.79.7.15. Avoid following any links promising romantic engagement; such narratives are hallmark lures for sextortion or monetary extortion. Users who may have visited should scan devices with an updated EDR solution and consider a password reset if credentials were reused on the site. Report the domain to local cybercrime units and NICENIC abuse channels to accelerate de-listing and certificate revocation.