krab1[.]ochagstone[.]ru

Analysts observed that the domain krab1.ochagstone.ru was registered on March 06, 2025 through the REGRU-RU registrar. The authoritative nameservers ns1.regerey.com and ns2.regerey.com resolve the domain to the IPv4 address 193.105.134.30, which belongs to ASN42237 operated by w1n ltd and is geolocated in Sweden. No TLS certificate is present; the site responded without HTTPS. The HTTP response page title reads 'krab1 - AT портал для любителей космоса', indicating a Russian-language portal about space enthusiasts, but no further content analysis is available because the site has been taken offline as of the report date, July 24, 2026.

Reputation services show a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has actively blocked the host. VirusTotal recorded a single positive detection out of 95 scanners, confirming that at least one security vendor flagged the domain as malicious. The limited detection footprint suggests a low-volume or rapidly-changed phishing campaign.

Because the infrastructure is hosted in Sweden under a known ISP, attribution to a specific threat actor remains uncertain. Defenders should continue to block the domain at perimeter defenses, monitor DNS queries for the associated IP and nameservers, and consider adding the host to internal blocklists. Additional investigation of any related domains using the same nameservers or IP range may reveal further components of the campaign. Until the site is re-hosted, no direct payload or credential-harvesting behavior can be confirmed, so threat confidence is elevated but evidence is limited to the observed infrastructure and the single vendor detection.