deepseek-chat[.]ru

This report analyzes the domain deepseek-chat.ru, which poses a threat as a fraudulent website impersonating the legitimate DeepSeek AI service. The site's page title, "DeepSeek нейросеть на русском - DeepSeek," indicates it masquerades as a Russian-language portal for the DeepSeek neural network. The primary threat is phishing or malware distribution, as the site likely aims to deceive users into providing credentials or downloading malicious software under the guise of a trusted AI platform.

Technical evidence confirms the site's malicious nature. VirusTotal analysis shows 7 out of 95 security vendors flagged the domain, including ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, and Fortinet. The domain is hosted on IP address 92.53.96.200, located in Russia under AS9123 JSC "TIMEWEB." The registrar is listed as REGISTRAR_NOT_FOUND, and the SSL certificate is issued by Let's Encrypt (R13). Nameservers are ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, and ns4.timeweb.org. No creation date is available in the provided data.

The site is currently offline, as indicated by its DOWN/OFFLINE status, but remains a risk due to its presence on one blocklist and a domain risk score of 68. This score suggests a high likelihood of malicious activity, warranting continued monitoring and blocking. The site's impersonation of DeepSeek and hosting on a Russian provider underscore its potential as a targeted threat for Russian-speaking users.