krab2-c-c[.]ru

The domain krab2-c-c.ru was registered on December 22 2025 through the REGRU-RU registrar and is presently taken offline. It is hosted on Cloudflare infrastructure, resolving to 172.67.158.238, an IP address located in the United States and owned by AS13335 Cloudflare, Inc. The domain uses Cloudflare name servers chad.ns.cloudflare.com and zoe.ns.cloudflare.com, and it does not present an SSL certificate, indicating that any web service would be delivered over plain HTTP. Public reputation data show a Gridinsoft trust score of 0 out of 100, which is the lowest possible rating and reflects a lack of confidence in the domain’s legitimacy. VirusTotal has recorded detections from 2 of 93 security vendors, confirming that at least a small subset of scanners consider the site malicious.

The domain is listed on a single external security blocklist and has been actively blocked by the PhishDestroy service, reinforcing the classification as a phishing resource. The only visible content attribute is the page title: “KRAB2 - Садовая техника и инструменты .CC .AT | Только сегодня скидка 50%”. The title advertises garden equipment and a 50 % discount, a pattern commonly used by fraudulent commerce‑related phishing campaigns. No SSL/TLS handshake is available, and no additional page content has been disclosed, leaving the precise phishing payload or credential‑capture mechanism unknown.

Given the observed indicators—low trust score, vendor detections, blocklist presence, lack of encryption, and a promotional title that aligns with typical phishing lures—defenders should treat krab2-c-c.ru as a malicious phishing host. Recommended actions include adding the domain to internal DNS and proxy blocklists, monitoring for any resurrection of the domain, and ensuring that outbound connections to the associated IP address are denied. Continued observation of the IP reputation and any future VirusTotal scans is advised to capture potential changes in threat behavior.