krk-zerkalo[.]ru

Analysis of the domain krk-zerkalo.ru shows a newly registered host that is actively serving HTTP content. The domain was created on March 28, 2026 and resolves to the IPv4 address 5.101.159.26. An HTTP GET request returns status code 200, indicating a live web server. The lack of an SSL certificate means all traffic is unencrypted, a common characteristic of credential‑harvesting sites. Infrastructure inspection reveals that the IP address is allocated to Beget Ltd in Russia, and the domain uses the provider’s default MX records (mx1.beget.com priority 10, mx2.beget.com priority 20). Gridinsoft assigns a trust score of 0 out of 100, effectively marking the host as untrusted. The domain appears on one public blocklist and has been flagged by the PhishDestroy filter, confirming that external defenses already consider it malicious. Threat intelligence sources corroborate the malicious classification. AlienVault OTX lists the domain in a single pulse, and VirusTotal reports that four out of ninety‑five scanning engines have identified it as malicious. Although the detection count is modest, the presence of any positive detections combined with the zero trust score and blocklist listing elevates the risk profile to high. The domain remains active as of the latest check on July 12, 2026. Defenders should treat krk-zerkalo.ru as a high‑confidence phishing indicator. Recommended actions include adding the domain and its resolving IP to network‑level deny lists, enforcing TLS inspection to capture any credential submissions, and updating email security gateways to block messages that reference the domain or its MX hosts. Continuous monitoring for new resolution changes or additional detections is advised to maintain situational awareness.