krab1-cc[.]atc-changan-s[.]ru

Analysis of the domain krab1-cc.atc-changan-s.ru indicates it was a phishing site targeting users through social engineering, as flagged by Google Safe Browsing. The domain, registered on March 6, 2025, through REGRU-RU, resolved to the IP address 193.105.134.30, hosted on AS42237 (w1n ltd) in Sweden. No SSL certificate was present, increasing the risk of unencrypted data interception. The page title matched the domain name exactly, suggesting a lack of effort to disguise the fraudulent nature or mimic a legitimate brand interface. Detection data reveals the domain was listed on at least one security blocklist, specifically PhishDestroy, and was flagged by 9 of 95 security vendors on VirusTotal.

Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. The domain is currently offline, though its infrastructure remains a potential vector for future campaigns if not fully dismantled. Infrastructure analysis shows the domain used nameservers ns1.regerey.com and ns2.regerey.com, which have been associated with other suspicious registrations. The registrar, REGRU-RU, has historically been linked to domains involved in phishing and fraud.

While the exact content or target brand beyond the 'Changan' reference in the domain name is not confirmed, the combination of social engineering flags, blocklist presence, and low trust scores indicates a deliberate attempt to deceive users. Defenders should monitor for re-registration or re-emergence of this domain or similar variants under the same registrar or hosting provider. Network-level blocking of the IP 193.105.134.30 and associated ASN may mitigate residual risk. Organizations are advised to review logs for connections to this domain prior to its takedown and assess potential exposure.