vozvrat-info[.]net

This domain, vozvrat-info.net, is flagged as a generic phishing site targeting individuals seeking legal consultation services. The page title, "Быстрый правовой разбор вашей ситуации" (translated: "Quick legal analysis of your situation"), suggests an attempt to impersonate legitimate legal advisory platforms. No specific brand impersonation or drainer kit signatures were identified, but the use of tracking technologies such as Facebook Pixel and IPinfo indicates an intent to profile victims for further exploitation or targeted follow-up attacks.

Infrastructure analysis reveals the domain was registered through Porkbun LLC on May 13, 2026, and resolves to the IP address 168.231.116.217. The domain is flagged by 5 out of 95 security vendors on VirusTotal, and it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites. Technologies detected include Nginx as the web server, jQuery for dynamic content, and third-party tracking tools, which are often leveraged to monitor victim interactions or exfiltrate data.

As of the latest assessment, vozvrat-info.net has been taken offline, likely in response to detection and blocking by security systems. However, the elevated risk persists due to the domain's recent registration and the potential for the threat actors to redeploy the infrastructure under a new domain or IP address. Organizations and individuals are advised to monitor for similar phishing campaigns targeting legal or financial services, particularly those using Cyrillic-language content and third-party tracking technologies. Blocking the resolved IP address (168.231.116.217) at the network level and updating endpoint protection rules to flag domains registered through Porkbun LLC with recent creation dates may mitigate residual risk.