prostitutki-blagoveshhensk[.]xyz

PhistDestroy identifies the domain prostitutki-blagoveshhensk.xyz as an active credential theft site currently under investigation. The domain mimics legitimate adult-service directories to harvest user credentials, posing a significant risk to personal and financial data security. Current status remains active, with threat actors actively refining lures to maximize compromise rates.

This domain was flagged by 2 of 95 VirusTotal vendors as of the latest scan, indicating it has evaded automated detection mechanisms. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 24, 2026, resolving to IP 80.79.7.26. The presence of a Let's Encrypt SSL certificate further enhances its deceptive legitimacy, complicating user-side detection. Trust scores for the IP and registrar remain neutral, but the domain’s recent creation and zero detections warrant heightened scrutiny.

Current status is active, with no confirmed takedown or mitigation in progress. PhistDestroy recommends immediate network-level blocking of prostitutki-blagoveshhensk.xyz and IP 80.79.7.26 to prevent credential theft. Users who may have interacted with this domain should reset passwords for all accounts using similar credentials and enable multi-factor authentication where available. Organizations should audit logs for anomalous login attempts tied to this domain’s IP or related infrastructure.