krab1-at[.]social-saratov[.]ru

The domain krab1-at.social-saratov.ru was registered on August 02, 2025 through the Russian registrar REGRU-RU and is currently taken offline. Its sole page carried the title “krab1 - эко-бренд CC стиля для современных горожан,” which does not reference a known brand or a legitimate service, suggesting a deceptive intent. Technical measurements show the domain resolves to IP address 193.105.134.30, hosted in Sweden and announced by ASN 42237 (w1n ltd). No TLS certificate is present, meaning all traffic would be unencrypted if the site were active, a common characteristic of low‑effort phishing infrastructure.

Independent scoring systems flag the domain as highly untrustworthy: Gridinsoft assigns a trust score of 0 out of 100, and Google Safe Browsing categorises the URL as social‑engineering, indicating it likely attempts to harvest credentials or personal data. The domain appears on one security blocklist and is listed by PhishDestroy as blocked. VirusTotal analysis shows seven of ninety‑five scanners flagged the site, reinforcing the suspicion of malicious content. Nameserver data (ns1.regerey.com, ns2.regerey.com) point to a generic hosting provider, offering no additional reputation signals.

While the site is no longer reachable, the combination of a recent creation date, absence of encryption, low trust score, multiple vendor detections, and explicit safe‑browsing warnings provides strong evidence that the domain was used for phishing. Defenders should continue to block the domain and its IP address at perimeter defenses, monitor for any re‑activation or similar domains registered with the same registrar, and consider adding the IP range to threat‑intel feeds. Ongoing vigilance is advised because the underlying hosting environment may be reused for future campaigns.