kra47at[.]haval-m-nch[.]ru

Analysis of kra47at.haval-m-nch.ru confirms a generic phishing domain targeting Russian-speaking users under the guise of an ecological waste-recycling service. The domain, registered on February 21, 2026, was flagged by 13 of 93 security vendors on VirusTotal and appears on at least one blocklist (PhishDestroy). Infrastructure analysis reveals the domain resolved to 193.105.134.30, an IP address hosted in Sweden under AS42237 (w1n ltd).

The SSL certificate is classified as R13, a low-trust indicator often associated with automated or malicious infrastructure. The page title, 'krab1 - экологичный AT сервис утилизации отходов,' suggests an attempt to impersonate a legitimate waste-management or recycling service, though no specific brand target is confirmed in available data. The domain has since been taken offline, but prior detections and its presence on blocklists indicate active abuse.

Defenders should treat this domain as part of a broader phishing campaign leveraging environmental or utility-themed lures. No further details about the phishing kit, payload, or victim interaction are available at this time. Monitoring for re-registration or reuse of the IP (193.105.134.30) or AS42237 infrastructure is recommended for proactive mitigation.