xn--80a6aa[.]xn--vetkea-2nfad7nzie41xhw7mfae[.]artes[.]cc

Analysis of the domain xn--80a6aa.xn--vetkea-2nfad7nzie41xhw7mfae.artes.cc indicates that it was registered on 21 February 2026 through Dynadot LLC and resolved to the IP address 91.212.166.67, which is geolocated to Russia. The authoritative nameservers are ns1.dyna-ns.net and ns2.dyna-ns.net, both typical of Dynadot‑hosted domains. No TLS certificate was observed, and the site was reachable only via HTTP before being taken offline. The page title returned by the server was "Home", providing no additional context about the content or targeted brand.

VirusTotal scans recorded nine positive detections out of ninety‑five submitted engines, confirming that multiple security vendors flagged the domain as malicious. The domain appears on a single public blocklist and has been specifically blocked by the PhishDestroy service, reinforcing its classification as a phishing resource. Current status is offline, which limits immediate observation but does not eliminate the risk that the infrastructure could be re‑used. Defenders should continue to monitor the associated IP address and nameserver set for any re‑activation, add the IP and domain to internal blocklists, and enforce outbound filtering to prevent connections to the host.

Because the site lacked SSL, any attempted credential capture would have been transmitted in clear text, making network‑level detection feasible. The absence of further intelligence such as payload samples or victim reports leaves the exact phishing lure unknown, so threat‑hunting teams should look for related traffic patterns, especially HTTP GET requests to the "Home" endpoint from compromised browsers. Ongoing vigilance is recommended until the infrastructure is confirmed retired.