eat[.]ru[.]com

This domain, eat.ru.com, is identified as a high-risk credential theft operation impersonating Google’s authentication infrastructure. Analysis indicates the site presented a fraudulent Intuit Accounts - Sign In page, a common tactic to harvest Google user credentials by mimicking trusted login portals. The domain targeted users seeking Google services, likely through malicious redirects or deceptive email campaigns, to capture sensitive account details under false pretenses. Evidence confirms the domain’s malicious intent through multiple technical indicators. VirusTotal reports 21 of 95 security vendors flagging eat.ru.com as malicious, while Google Safe Browsing explicitly classifies it as a phishing threat. Infrastructure analysis reveals the domain resolved to IP 155.2.192.158, hosted on AS19318 (Interserver, Inc) in the US, and lacked an SSL certificate, a red flag for secure authentication portals. The domain was registered through Sav.com, LLC and appeared on at least one security blocklist prior to being taken offline. No legitimate association with Google or Intuit was found. Users who visited eat.ru.com should immediately revoke any entered credentials, particularly Google account passwords, and enable multi-factor authentication on all linked services. Monitor accounts for unauthorized activity, including login attempts or password changes, and report any suspicious behavior to the affected platform’s security team. If financial or sensitive data was submitted, consider placing a fraud alert with credit bureaus and reviewing transaction histories for anomalies. Organizations should update endpoint protection rules to block the domain and associated IP, and educate users on recognizing brand impersonation tactics in credential theft campaigns.