krab2cc[.]zagatovkin[.]ru
“krab2 - воплощает муниципалитет СС уровня”
krab2cc.zagatovkin.ru — Konten tidak tersedia. Ringkasan bukti: VirusTotal 10/95 (alphaMountain.ai, BitDefender, CRDF, CyRadar, Fortinet); Google Safe Browsing flagged; PhishDestroy score 80/100. Registrar: REGRU-RU.
Analisis terperinci PhishDestroy AI di bawah tetap berbahasa Inggris untuk menjaga catatan forensik asli.
On July 24 2026, the domain krab2cc.zagatovkin.ru was observed as part of a high‑risk generic phishing campaign. The site was provisioned on 2 August 2025 and resolves to the IPv4 address 193.105.134.30, which belongs to AS42237 operated by w1n ltd and is geolocated in Sweden. No TLS certificate was presented, indicating HTTP‑only service. The page title returned by the server, “krab2 - воплощает муниципалитет СС уровня”, suggests the content attempts to portray a municipal‑level service, although the exact target of impersonation cannot be confirmed from the available data. Google Safe Browsing classified the domain under social engineering, and the domain appears on one security blocklist that is currently enforced by PhishDestroy.
Independent analysis on VirusTotal showed that ten out of ninety‑five scanners flagged the domain as malicious, reinforcing the suspicion of phishing activity. Additional reputation signals are extremely poor: Gridinsoft assigned a trust score of 0 out of 100, and the domain is listed with a registrar identified as REGRU‑RU. The authoritative nameservers are ns1.regerey.com and ns2.regerey.com. As of the reporting date the hosting appears to be taken offline, but the infrastructure components remain visible and could be re‑activated.
Defenders should immediately add the domain and its resolved IP address to deny‑list rules on perimeter and endpoint controls, monitor DNS queries for the associated nameservers, and consider watching the registrar for any rapid re‑registration activity. Because the site currently lacks HTTPS, any future re‑deployment would be trivially detectable through missing certificate validation. Continuous threat‑intel feeds that reference the same IP or ASN should be correlated to detect possible resurgence. Until further evidence emerges, the domain should be treated as a confirmed high‑risk phishing indicator.
Alur Tanggapan Ancaman Pipeline
Status Daftar Blokir Publik
Analisis VirusTotal
Bukti & Laporan Eksternal
Apakah Anda Terpengaruh oleh Situs Ini?
Jika Anda memasukkan kredensial akun, informasi pribadi atau pembayaran, atau mengunduh file dari domain ini, segera ambil tindakan. Di bawah ini adalah sumber daya untuk membantu Anda melaporkan insiden tersebut dan melindungi diri Anda sendiri.
Laporkan kepada Pihak Berwenang di Daerah Anda
Pilih negara Anda untuk mendapatkan kontak resmi kejahatan dunia maya, atau membuat draf pengaduan →.
Periksa Domain Apa Pun
Analisis ancaman menggunakan daftar blokir yang disimpan, WHOIS, DNS, dan bukti pemindaian publik
Pindai SekarangLaporkan Phishing
Laporkan domain yang mencurigakan ke basis data ancaman kami — lindungi komunitas
LaporanPemberitahuan Ancaman Real-Time
Laporan phishing terbaru dan perubahan ketersediaan yang diamati
PantauTetap Terinformasi, Tetap Aman
Pantau ancaman secara langsung atau ajukan keberatan terhadap daftar ini jika Anda yakin ini merupakan false positive