kr-ab5-cc[.]ru

Domain kr-ab5-cc.ru has been flagged by PhishDestroy as a crypto-drainer endpoint under active abuse. The domain is not impersonating a specific brand but is engineered to intercept and drain cryptocurrency wallet transactions via malicious JavaScript payloads. Threat intelligence indicates the domain is configured to serve a drainer kit that scans for Web3 wallet extensions (MetaMask, Phantom, Rabby, etc.) and silently replaces destination addresses at transaction signing time. No overt brand mimicry is observed, suggesting a generic but highly effective drainer deployment rather than a targeted phishing campaign.

Technical indicators are consistent with a newly stood-up operation: the domain was created on March 08, 2026 through REGRU-RU, resolving to IP 172.67.164.20. It acquired a Let’s Encrypt SSL certificate within hours of registration, enabling encrypted payload delivery. VirusTotal currently shows 2/95 detections and the domain remains unlisted by Google Safe Browsing (GSB) and all major public blocklists. WHOIS data is masked, a common tactic to delay takedown response. The seed identifier 200c89 confirms this is a tracked, evolving threat with no prior reputation, heightening the risk of rapid propagation across social media and phishing feeds.

As of this report, kr-ab5-cc.ru is active and unblocked. Immediate containment requires DNS sinkholing or browser policy blocks at the organizational level. Users should avoid visiting the domain and report any accidental access to wallet providers and security teams. Risk remains high until VT detections rise above 3/95 or GSB flags the domain, which historically occurs 24–72 hours after first abuse reports. Until then, the domain presents an active, low-signature threat with severe wallet-compromise potential. Disable Web3 extensions on untrusted networks and treat any transaction popup from this domain as hostile.