krab5--cc-c[.]ru

The domain krab5--cc-c.ru was registered on 20 February 2026 through the Russian registrar REGRU‑RU. Its authoritative name servers are elijah.ns.cloudflare.com and emely.ns.cloudflare.com, both hosted by Cloudflare, and the domain resolves to the IP address 188.114.97.3, which is part of the Cloudflare network. Independent scanning on VirusTotal returned four positive detections out of ninety‑one submitted security engines, indicating that multiple vendors have identified malicious activity associated with this host.

The domain is listed on a single public blocklist and has been actively blocked by the PhishDestroy sinkhole, confirming that it is being used in a phishing campaign. No additional telemetry such as SSL certificate details, HTTP response codes, page titles, or content snapshots have been published, so the exact luring technique and targeted brand remain unknown. Infrastructure analysis shows no anomalous ASN or geographic shifts beyond the Cloudflare edge location, suggesting the attacker is leveraging a standard CDN to obscure origin.

Defenders should add krab5--cc-c.ru to URL filtering and DNS block policies, monitor traffic to 188.114.97.3 for suspicious authentication attempts, and enforce multi‑factor authentication for any credentials potentially harvested through this vector. Ongoing collection of web payloads and user‑reporting will be required to refine the threat profile and to confirm the specific phishing lure employed.