krab1at[.]stroygarant2012[.]ru

On 24 July 2026, analysis of the domain krab1at.stroygarant2012.ru confirms that it operated as a phishing site before being taken offline. The domain was registered on 2 August 2025 through the Russian registrar REGRU‑RU and uses the authoritative name servers ns1.regerey.com and ns2.regerey.com. DNS resolution points to the IPv4 address 193.105.134.30, which belongs to AS42237 (w1n ltd) and is geolocated to Sweden. No TLS certificate is presented, indicating that the site was served over plain HTTP only.

The page title retrieved from the live host was "krab1 – инновационная CC методика изучения английского языка", suggesting a focus on language‑learning content, but no further content analysis is available. VirusTotal scanned the domain and recorded detections from 11 of 95 security vendors, demonstrating a moderate level of malicious classification. Independent reputation services corroborate the risk: Gridinsoft assigned a trust score of 0 out of 100, the domain appears on one public blocklist, and Google Safe Browsing flags it for social engineering. PhishDestroy has also listed the domain as blocked.

Given the combination of registrar information, low‑reputation hosting, lack of encryption, and multiple vendor detections, the infrastructure is consistent with a high‑risk phishing operation. Defenders should continue to block the domain at perimeter defenses, update URL filtering and threat‑intel feeds, and monitor the associated IP address 193.105.134.30 for any resurgence of malicious activity. Because the site is currently offline, any future re‑hosting would likely reuse the same registration and hosting patterns, so alerts can be tuned to detect similar reappearances. No additional indicators such as payloads, phishing kits, or compromised credentials have been disclosed, leaving those aspects uncertain pending further investigation.