1krab-cc[.]ru

This domain, 1krab-cc.ru, is flagged for brand impersonation targeting Telegram, as indicated by the threat type. The page title KRAb1 — домашние тренажёры CC по габаритам и бюджету suggests a phishing page designed to mimic Telegram's branding, potentially using a drainer kit to harvest credentials. The domain was registered on February 21, 2026, through REGRU-RU, and resolves to IP 104.21.88.3, indicating infrastructure possibly leveraging Cloudflare for obfuscation.

Technical indicators include a VirusTotal detection score of 1 out of 95 security vendors flagging the domain, representing a low detection rate. The domain is listed on one security blocklist and is blocked by PhishDestroy. Gridinsoft trust score is 0 out of 100, confirming high risk. Google Safe Browsing (GSB) status is not provided but the domain's offline status suggests accelerated response. The registrar REGRU-RU indicates Russian-registered infrastructure, complicating takedown efforts.

Current status is offline, presumably due to proactive takedown actions. Risk remains for users who may have visited the domain before it was taken offline, as credentials could have been compromised. Recommended actions include monitoring accounts for unauthorized access, enabling two-factor authentication on Telegram, and scanning devices for malware. Users should verify official Telegram domains and avoid entering credentials on suspicious sites.