narkolog[.]biz

This domain, narkolog.biz, is identified as a credential theft operation designed to harvest user login credentials through deceptive CAPTCHA verification prompts. The page title "Вы не робот?" ("Are you not a robot?" in Russian) suggests an attempt to impersonate legitimate security checks, a common tactic in credential phishing campaigns. No direct brand impersonation or cryptocurrency drainer kit signatures were observed, but the infrastructure aligns with credential theft frameworks targeting Russian-speaking users or regional services. Infrastructure analysis reveals the domain was registered on October 10, 2023, through NiceNIC International Group Co., Limited. It resolves to the IP address 91.206.71.55 and is currently flagged by 12 out of 95 security vendors on VirusTotal. The Gridinsoft trust score for this domain is 0/100, indicating high risk. The domain appears on one security blocklist and is protected by Cloudflare, a technique frequently used to obscure hosting origins and evade detection. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect a lag in detection rather than absence of malicious activity. As of the latest verification, narkolog.biz has been taken offline, likely in response to detection by security blocklists such as PhishDestroy. However, the residual risk remains elevated due to the domain's recent registration, use of anonymization services, and prior credential theft indicators. Organizations and users are advised to monitor for similar domains registered through the same registrar or resolving to the same IP range. Network-level blocking of 91.206.71.55 is recommended, along with user education on recognizing CAPTCHA-themed credential theft attempts. Continuous scanning for related infrastructure is warranted, as threat actors often re-deploy phishing kits under new domains.