marijamoertl[.]online

This domain, marijamoertl.online, has been identified as a credential theft operation targeting users through a deceptive financial coaching facade. The site is currently active and presents itself under the title "Финансовый карма-коуч," suggesting a focus on Russian-speaking individuals seeking financial advice. Analysis indicates this is not a generic phishing attempt but a targeted effort to harvest login credentials, payment details, or personal information under the guise of a legitimate service. Infrastructure analysis reveals the domain was registered on May 06, 2021, through Registrar of Domain Names REG.RU LLC. It resolves to the IP address 194.48.203.77 and employs a Let's Encrypt SSL certificate, which, while providing encryption, does not validate the legitimacy of the site. As of the latest scan, the domain has been flagged by 0 of 95 VirusTotal vendors, indicating it has not yet been widely recognized as malicious. The site utilizes multiple tracking and development technologies, including Tilda, jQuery, Hammer.js, Google Tag Manager, Google Analytics, and Facebook Pixel, which may be leveraged to monitor user interactions and optimize the credential harvesting process. The domain remains active, and no blocklist entries or trust score downgrades have been recorded at this time. Given the lack of detections and the use of legitimate-seeming infrastructure, this poses a moderate to high risk to unsuspecting users. Organizations and individuals are advised to block access to this domain at the network level and monitor for any connections to the IP address 194.48.203.77. Users who may have interacted with the site should immediately reset credentials for any accounts accessed during the session and enable multi-factor authentication where possible. Security teams should treat this domain as a potential credential theft vector and investigate any related network traffic or endpoint activity.