zakupi-rf-pasport[.]com

The domain zakupi-rf-pasport.com is identified as a phishing platform specifically targeting individuals seeking fraudulent Russian Federation passports or duplicates. Analysis indicates this domain operates as a credential and identity theft scheme, advertising counterfeit government-issued documents under the guise of legitimate services. The domain is currently offline, though prior activity suggests it may reemerge under similar infrastructure. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, resolving to the IP address 85.208.186.116. Security telemetry shows the domain was flagged by 3 of 95 VirusTotal vendors and appears on one security blocklist, with a Gridinsoft trust score of 0/100. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to malicious sites. AlienVault OTX records the domain in one threat intelligence pulse, further confirming its association with fraudulent activity. The page title, "Купи паспорт РФ или дубликат за 5 дней," explicitly advertises the sale of Russian passports or duplicates within five days, a clear indicator of illicit intent. Current status indicates the domain has been taken offline, likely due to enforcement actions or infrastructure changes. However, similar domains often reappear under altered registrant details or hosting providers. Organizations and individuals are advised to block the domain and its associated IP address (85.208.186.116) at the network perimeter. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range. End-users should be educated on recognizing fraudulent document schemes, particularly those promising government-issued credentials for purchase.