krab1-cc[.]himki-trans[.]ru

Analysis of the domain krab1-cc.himki-trans.ru indicates it is a confirmed phishing site targeting users with a fraudulent smoke filtration and purification system interface. The domain was registered on August 2, 2025, through REGRU-RU, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolves to the IP address 193.105.134.30, hosted on AS42237 (w1n ltd) in Sweden, a network segment previously linked to phishing and malware distribution. No SSL certificate is present, increasing the risk of unencrypted data interception.

The domain uses nameservers ns1.regerey.com and ns2.regerey.com, which have been observed in other malicious campaigns. The page title, 'krab1 - CC система фильтрации и очистки дыма,' suggests a localized phishing scheme, likely targeting Russian-speaking users under the guise of a smoke filtration system. While the exact content and functionality of the site remain unanalyzed due to its offline status, the domain appears on one security blocklist and is flagged by 10 of 95 security vendors on VirusTotal, confirming its malicious classification.

GridinSoft assigns a trust score of 0/100, further validating its high-risk nature. PhishDestroy has already blocked the domain, and it is currently offline, though defenders should monitor for potential re-emergence under similar infrastructure or registrant details. Organizations are advised to block the domain, IP, and associated nameservers at the network level and alert users to avoid interaction with any related communications or redirects.