socialvisor[.]ru

The domain socialvisor.ru was a phishing site engaged in brand impersonation, specifically targeting Telegram users. It posed an elevated risk by mimicking legitimate Telegram services to deceive victims into disclosing sensitive information or credentials. No crypto drainer kit was detected. The site is currently taken offline, but its prior activity remains a concern for those who may have interacted with it.

Technical analysis shows socialvisor.ru was flagged by 1 of 95 VirusTotal security vendors and appeared on 1 security blocklist (PhishDestroy). It was registered through RU-WEBDC-20180329 (ASN: 29182) and resolved to the IP address 185.253.34.171, located in Russia under AS29182 JSC IOT. The SSL certificate was issued by Let's Encrypt (R13), and the observed page title was 'SocialVisor'. Technologies detected included Three.js, Cloudflare, Yandex.Metrika, Unpkg, reCAPTCHA, DDoS-Guard, cdnjs, and AOS. MX records pointed to emx.mail.ru, and nameservers were ns1.reg.ru and ns2.reg.ru. Google Safe Browsing did not flag the domain, and the Gridinsoft trust score was 0/100.

Individuals who visited socialvisor.ru should take immediate action to secure their accounts. If credentials were entered, change passwords for Telegram and any other services where the same credentials may have been reused. Enable two-factor authentication (2FA) on all accounts to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or messages sent without consent. Report the phishing domain to Telegram’s abuse team and consider submitting it to additional threat intelligence platforms like PhishTank or OpenPhish to help prevent further exploitation.