klab1at[.]ru

Analysis of klab1at.ru indicates that the domain was registered on 19 December 2025 through the Russian registrar REGRU‑RU. The authoritative name servers are ns1.offshorehosting.name and ns2.offshorehosting.name, both pointing to an offshore hosting provider. DNS resolution returns the address 185.246.128.44, which is announced by AS42237 (w1n ltd) and geolocated to Sweden. The host presents no TLS certificate, causing HTTPS connections to fail and forcing HTTP access. An HTTP request returns a 404 Not Found page title, suggesting the web service is currently disabled or removed.

Threat‑intelligence feeds have placed the domain on a single blocklist; it is actively blocked by the PhishDestroy service. The Gridinsoft trust score is 0 / 100, reflecting a high confidence of malicious intent. VirusTotal scans show that three of ninety‑three security vendors flagged the domain, confirming at least partial detection by automated tools. The domain is currently marked offline, and no further content has been observed. The available evidence points to a short‑lived generic phishing infrastructure that was likely used to host credential‑harvesting pages before being taken down.

The lack of a valid SSL certificate, combined with the 404 response, limits immediate analysis of the payload. Defenders should continue to block the domain at network perimeter and DNS filtering layers, monitor the associated IP address for any re‑use, and consider adding the host to internal blocklists. Ongoing watch‑listing of the offshore name servers and the registrar REGRU‑RU is advised, as they have been used in other malicious campaigns. Because the domain is already offline, incident response actions should focus on identifying any compromised accounts or credentials that may have been exfiltrated during its brief operational window.