auth[.]krevetka[.]cc

The domain auth.krevetka.cc is currently classified as a high‑risk generic_phishing site and remains active as of 12 July 2026. The page title returned by the server is "Авторизация — krevétka", indicating a Russian‑language authorization prompt. The domain was registered on 27 December 2024 through NameCheap, Inc. and resolves to the IPv4 address 87.249.54.192, which belongs to the Russian AS9123 JSC TIMEWEB network. The hosting stack consists of Ubuntu operating system, Nginx web server, and Cloudflare DNS resolution (nameservers jaxson.ns.cloudflare.com and shubhi.ns.cloudflare.com). The site serves content over TLS with a certificate issued by Google Trust Services under the WE1 identifier. Traffic analysis shows an HTTP 302 redirect response, and the page loads third‑party assets from Yandex.Metrika, jsDelivr, and cdnjs, suggesting the use of common analytics and CDN libraries.

Threat intelligence indicates that 3 of 95 security vendors on VirusTotal have flagged the domain, and Gridinsoft assigns it a trust score of 0 out of 100. The domain is present on a single public blocklist and has been blocked by the PhishDestroy mitigation platform. No additional payloads or malicious files have been observed, and the specific phishing kit or credential‑harvesting mechanism remains unknown. The lack of publicly disclosed landing page content limits the ability to confirm the exact credential targets or spoofed services.

Defenders should prioritize blocking network connections to 87.249.54.192 and associated Cloudflare nameservers, and add auth.krevetka.cc to email gateway and web filtering deny lists. Monitoring of outbound traffic for any attempts to communicate with the domain, especially after an HTTP 302 redirection, is advised. Given the low trust score and vendor flags, incidents involving credential submission to this domain should be treated as compromise attempts, and affected accounts must be reset and monitored for anomalous activity.