narcolog24[.]biz

Analysis of narcolog24.biz indicates a confirmed phishing domain targeting Russian-speaking users through a CAPTCHA-themed deception vector. The domain, registered on October 19, 2023, via NiceNIC International Group Co., Limited, is currently offline but was previously flagged by PhishDestroy and appears on one security blocklist. Infrastructure analysis reveals the domain resolved to 91.206.71.144, an IP address geolocated in the Netherlands and associated with AS13335 (Cloudflare, Inc.), a common hosting choice for phishing campaigns due to its proxy services. The nameservers (david.ns.cloudflare.com and dina.ns.cloudflare.com) further confirm Cloudflare's involvement in the domain's DNS resolution.

Notably, the domain lacks an SSL certificate, increasing the likelihood of interception or manipulation of unencrypted traffic. The page title, 'Вы не робот?' (translated as 'Are you not a robot?'), suggests an attempt to mimic legitimate CAPTCHA verification processes, a tactic frequently employed to harvest credentials or deliver malware. While only 2 of 95 security vendors on VirusTotal flagged the domain, this limited detection does not diminish the elevated risk level, particularly given the domain's presence on a blocklist and its historical use of Cloudflare's infrastructure to obscure malicious activity.

Defenders should treat this domain as compromised and prioritize blocking both the domain and its associated IP address (91.206.71.144) at the network level. Monitoring for related domains registered through NiceNIC or utilizing Cloudflare nameservers may help identify additional threats. The absence of SSL and the domain's current offline status do not preclude future reactivation; thus, continuous monitoring and retrospective analysis of logs for connections to this domain are recommended.