at-krab4-cc[.]ru

The domain at-krab4-cc.ru was registered on March 28, 2026 and is currently classified as a high‑risk generic phishing site. Its active status is confirmed as of July 12, 2026, and the page title presented to visitors reads “krab4 cc – Новое рабочее зеркало”. The presence of a Russian‑language mirror page suggests an attempt to lure native speakers. Technical resolution points to the IPv4 address 5.23.52.13, which is hosted by JSC “TIMEWEB” in Russia. The site serves content over HTTPS using a Let’s Encrypt certificate (E7). Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating a lack of benign reputation. VirusTotal analysis shows that 5 of 95 scanned security vendors flagged the domain as malicious. The domain appears on a single public security blocklist and is explicitly blocked by the PhishDestroy filtering service. AlienVault OTX reports the domain in eight separate threat‑intelligence pulses, reinforcing the view that it is part of a broader malicious infrastructure. Despite the limited number of blocklist entries, the convergence of multiple independent detections underscores a credible threat. Defenders should prioritize blocking traffic to at-krab4-cc.ru at perimeter defenses and update DNS filtering rules accordingly. Continuous monitoring of the associated IP address 5.23.52.13 for anomalous connections is recommended, as is the collection of any payload samples delivered from the site for deeper malware analysis. Given the high risk rating and active phishing classification, organizations should treat any email or web interaction referencing this domain as potentially compromised.