mail[.]volgatermy[.]key4day[.]ru

Analysis indicates that mail.volgatermy.key4day.ru is an active phishing domain targeting Outlook Web Access users. The domain was registered on February 21, 2026, through RU-CENTER-RU and is hosted on infrastructure associated with AS9123 (JSC TIMEWEB) in Russia, resolving to IP address 92.53.96.117. The page title is explicitly set to 'Outlook,' aligning with the identified brand impersonation threat type. The domain is currently returning an HTTP 302 redirect status, which may be used to obscure final landing pages or evade detection. Nameservers are provided by Timeweb (ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, ns4.timeweb.org), a common hosting pattern for malicious domains in this region. Technical indicators include the use of Nginx as the web server technology and a GlobalSign SSL certificate (GlobalSign GCC R3 DV TLS CA 2020), which does not validate legitimacy but may lend a false sense of security to victims. The domain has been flagged by 18 of 95 security vendors in aggregated scans, and it appears on at least one security blocklist. Gridinsoft assigns a trust score of 0/100, further supporting its classification as high-risk. Defenders should treat this domain as actively malicious. Network-level blocking of 92.53.96.117 and the domain itself is recommended. Security teams should monitor for credential harvesting activity linked to this infrastructure, particularly targeting corporate or personal email accounts. The exact content of the phishing page is not yet analysed, but the combination of Outlook branding, Russian hosting, and recent registration strongly suggests an intent to deceive users into submitting login credentials. No evidence of additional scam categories (e.g., crypto, investment) is present in current intelligence.