krab1-at-onion[.]ru

PhishDestroy identifies krab1-at-onion.ru as an active credential-harvesting domain designed to trick users into surrendering sensitive login credentials. This onion-themed domain mimics legitimate login portals, luring victims with deceptive branding and social-engineering prompts to extract usernames, passwords, and multi-factor authentication tokens. The infrastructure behind the site has been provisioned rapidly, with the domain registered through RU-CENTER-RU on December 19, 2025, and resolved to IP 172.67.160.28 using a Google Trust Services SSL certificate—indicators commonly abused in low-overhead phishing campaigns targeting global users. This domain remains largely undetected, with zero detections out of 95 engines on VirusTotal at the time of analysis. Its recent creation date and clean reputation suggest opportunistic deployment, likely in response to current events or seasonal spikes in user activity. The combination of a freshly registered domain, low detection coverage, and trusted certificate infrastructure elevates the risk profile, positioning this domain as a high-probability threat vector for credential theft and follow-on attacks such as account takeover and session hijacking. Users who have visited krab1-at-onion.ru are advised to immediately change passwords for any accounts exposed during the visit, enable multi-factor authentication where possible, and scan devices for malware or unauthorized access. Report suspicious activity to your security team and avoid interacting with the domain further. Organizations are urged to block the domain at the network perimeter and monitor for inbound or outbound connections to 172.67.160.28, while updating threat intelligence feeds with the domain and associated IP to prevent future exposure.