stroygarant2012[.]ru

This domain, stroygarant2012.ru, is identified as a credential harvesting phishing site targeting individuals involved in construction projects. Analysis indicates the site masquerades as a legitimate project guarantee service, using Russian-language content with the page title 'krab1 - гарантия в каждом строительном проекте' to deceive victims into submitting sensitive information such as login credentials or financial details. The domain currently holds an offline status but remains a documented threat in security databases. Infrastructure analysis reveals the domain was registered through REGRU-RU on August 02, 2025, and resolves to the IP address 193.105.134.30. It appears on one security blocklist and has been flagged by 3 of 95 vendors on VirusTotal, indicating moderate detection coverage. The Gridinsoft trust score for this domain is 0/100, reflecting its confirmed malicious nature. Additional technical indicators include its prior blocking by PhishDestroy and the use of a recently created domain to evade reputation-based defenses. The domain is currently offline, but organizations should treat it as a persistent threat vector. Recommended actions include adding stroygarant2012.ru and its associated IP (193.105.134.30) to network blocklists, implementing email filtering rules to quarantine messages referencing this domain, and conducting user awareness training to recognize similar phishing lures. Security teams should monitor for re-registration attempts or shifts in hosting infrastructure, as phishing domains often resurface under altered configurations.