krab2-a-t[.]ru

On July 22 2026, the domain krab2-a-t.ru was observed to be offline after being identified as a phishing infrastructure. The domain was registered on December 22 2025 through the Russian registrar REGRU-RU. DNS resolution points to the IP address 172.67.151.237, which belongs to Cloudflare, Inc. (ASN13335) and is geolocated in the United States. The domain is served without an SSL certificate, indicating that traffic is not protected by HTTPS. The page title retrieved before takedown reads “KRAB2 - Автомобильные аксессуары и тюнинг .CC .AT | Только сегодня скидка 50%”, suggesting a lure focused on automotive accessories and a 50 % discount claim.

Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, and the site has been added to the PhishDestroy blocklist as well as a second, unspecified security blocklist. VirusTotal scans show that two of ninety‑three antivirus engines flagged the domain as malicious, confirming the presence of at least some detectable malicious components. The nameservers listed are chad.ns.cloudflare.com and zoe.ns.cloudflare.com, both standard Cloudflare nameservers, which further obscures the true hosting environment. The available evidence is limited to registration metadata, DNS infrastructure, and the observed page title; no payload samples, credential‑stealing forms, or redirection chains have been publicly released.

Consequently, the specific phishing kit or victim data collection method remains unknown. Defenders should update domain‑blocking policies to include krab2-a-t.ru, monitor for any future re‑registration of the same name or similar variants, and consider Cloudflare’s IP range as a potential vector for related malicious activity. Continuous re‑scanning with multi‑engine services is advised to capture any new detections that may arise if the infrastructure is revived.