krab1cc[.]ashi13[.]ru

On July 23, 2026, the domain krab1cc.ashi13.ru was observed as part of a generic phishing campaign. The site was registered on August 5, 2025 through the Russian registrar REGRU-RU and uses the nameservers ns1.regerey.com and ns2.regerey.com. DNS resolution points to the IPv4 address 91.236.116.210, which is allocated to AS42237 w1n ltd in Sweden. No TLS certificate was presented, indicating the site operated over plain HTTP. The page title returned by the server is the literal string “krab1cc.ashi13.ru”, providing no additional context about the lure or target.

Google Safe Browsing classifies the URL as a social engineering threat, and the domain is currently flagged on one public blocklist. Independent scanning on VirusTotal recorded detections from 13 of 93 security vendors, confirming the presence of malicious payloads or phishing techniques. The Gridinsoft trust score is 0 out of 100, and the site has been taken offline and is listed as blocked by the PhishDestroy mitigation service. The available evidence confirms the domain’s involvement in phishing activity, but the specific victim lures, credential‑stealing pages, or any associated command‑and‑control infrastructure have not been publicly disclosed.

Absence of an SSL certificate and the simple page title suggest a low‑complexity deployment, yet the multiple vendor detections indicate that at least some of the content matched known phishing signatures. Defenders should continue to block the domain at network perimeter filters, update URL filtering lists with the observed name, and monitor for any new subdomains created under the same registrar or nameserver configuration. Additional analysis of traffic to the associated IP address may reveal related malicious hosts, and any future re‑registration attempts should be proactively denied.