krab-1--------cc[.]ru

Analysis of the domain krab-1--------cc.ru shows a recent phishing infrastructure that was taken offline prior to this report (July 24, 2026). The registrar listed is REGRU-RU and the domain was created on December 09, 2025, indicating a short lifespan typical of malicious campaigns. DNS resolution points to the IP address 198.18.1.235, hosted under the nameservers ns1.armadns.com and ns2.armadns.com. The site presented a page title in Russian – "Портал мягкой мебели и аксессуаров — комфорт и стиль для вашего дома" – which advertises a furniture and accessories portal, a common lure for credential‑stealing pages.

Security diagnostics reveal a Gridinsoft trust score of 0 / 100 and a Let’s Encrypt R12 certificate, both suggestive of low‑quality or throwaway hosting. HTTP responses returned a 502 status code, consistent with the offline state. The domain appears on one security blocklist and is explicitly blocked by the PhishDestroy service. Detection engines on VirusTotal flagged the domain in 5 of 95 scans, confirming suspicion without indicating a broad consensus.

Technologies observed on the page include Yandex.Metrika and DDoS‑Guard, which are often present on compromised or malicious sites to gather analytics and mitigate takedown attempts. While the exact phishing payload (e.g., credential‑stealing form) has not been captured, the combination of a deceptive page title, low trust score, recent creation, and multiple detections strongly suggests a generic phishing operation. Defenders should continue to block the domain and its resolving IP, monitor the associated nameservers for re‑registration, and add the domain to internal URL‑filtering lists. Continued observation of threat intelligence feeds for any re‑appearance of the same infrastructure is advised.