srm24[.]cc

Analysis of the domain srm24.cc indicates active phishing infrastructure targeting users under the guise of a 'SARMAT SHOP,' as evidenced by the page title. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and remains operational as of July 12, 2026. It resolves to IP address 172.67.201.98 and is protected by Cloudflare, utilizing technologies such as Three.js, particles.js, jsDelivr, and cdnjs, alongside HTTP/3 for content delivery. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. The domain is flagged by 12 of 95 security vendors on VirusTotal and appears in 24 threat intelligence pulses on AlienVault OTX, suggesting widespread recognition as malicious. It is currently listed on two security blocklists, PhishDestroy and BLP-Malware, and holds a trust score of 0/100. While the exact content of the site has not been analyzed, the page title and classification as 'generic_phishing' indicate an intent to deceive users, likely through fraudulent transactions or credential harvesting. Defenders should treat this domain as high-risk and implement blocking measures at the DNS or network level. Given its active status and consistent detection across multiple threat intelligence sources, monitoring for related domains or IPs associated with the same infrastructure is recommended. No specific brand impersonation beyond the 'SARMAT SHOP' title has been confirmed, and further investigation into the site's content is necessary to determine the full scope of the threat.