sferium[.]com[.]ua

This domain, sferium.com.ua, poses as a legitimate Ukrainian logistics company under the name 'Логістична компанія Sferium' to deceive visitors into submitting sensitive credentials. Analysis indicates the site is designed to harvest login details, financial information, or other personal data through fraudulent forms or cloned interfaces. The threat is particularly insidious due to its targeted approach, mimicking a trusted local business to lower user vigilance. Infrastructure analysis reveals the domain was created on October 4, 2021, and is registered through ТОВ 'Інтернет Інвест'. It resolves to the IP address 185.104.45.93, hosted by AS200000 Hosting Ukraine LTD. Despite its active status, only 1 out of 95 security vendors on VirusTotal currently flag the domain as malicious. The site employs a Let's Encrypt SSL certificate, which may create a false sense of security for visitors. Additionally, it appears on one security blocklist and is actively blocked by at least one anti-phishing system. If you or someone in your organization has visited sferium.com.ua, immediate action is required. First, cease all interaction with the site and do not enter any credentials or personal information. Next, change passwords for any accounts accessed from the same device or network, prioritizing email, banking, and work-related systems. Monitor financial statements and credit reports for unauthorized activity. Report the domain to local cybersecurity authorities and consider scanning the affected device with updated security tools to detect potential malware or backdoors. Organizations should also notify their IT or security teams to assess potential exposure and implement additional monitoring.