https-krab1------cc[.]ru

Analysis on https-krab1------cc.ru, identified as a generic phishing infrastructure, shows that the domain was created on December 09, 2025 and is currently taken offline. The authoritative name servers ns1.armadns.com and ns2.armadns.com resolve the domain to the address 198.18.1.192. No TLS certificate is presented, indicating that the site operated over plain HTTP. The page title returned by the server is identical to the domain name, providing no additional context about a targeted brand or service.

The registration was performed through the Russian registrar REGRU-RU, and the domain has been listed on a single security blocklist. PhishDestroy has already blocked the domain, and Gridinsoft assigns it a trust score of zero out of one hundred, reflecting a high confidence of malicious intent. VirusTotal analysis reports ten detections out of ninety‑five scanned engines, confirming that multiple security products consider the host malicious. The combination of a recent registration, lack of encryption, low trust rating, and multiple vendor detections points to a purpose‑built phishing operation.

Uncertainty remains regarding the exact phishing campaign payload, the specific victim demographic, and whether any command‑and‑control infrastructure is associated with the IP address. Defenders should continue to block the domain at DNS and network layers, monitor for any resurgence of the IP address, and incorporate the domain indicator into threat‑intel feeds. Ongoing observation of the hosting provider and registrar may reveal additional related candidates, and any future resolution of the domain should be treated as high‑risk.