krab1[.]mvm-context[.]ru

Analysis of krab1.mvm-context.ru indicates that the domain is presently offline but retains a high‑risk profile based on multiple independent detections. VirusTotal records show that 16 of 95 scanned security vendors flagged the domain, demonstrating a notable consensus of malicious behavior. Google Safe Browsing classifies the URL as a social‑engineering threat, and the PhishDestroy service has already blocked access to the site. The domain also appears on a single external security blocklist, reinforcing the consensus that it is being used for illicit purposes.

Registration data reveals that the domain was created on March 07, 2025 through the REGRU‑RU registrar, and it resolves to IP address 193.105.134.30, which is assigned to AS42237 (w1n ltd) in Sweden. The hosting infrastructure is identified by the nameservers ns1.regerey.com and ns2.regerey.com. No SSL certificate is present, and the page title returned by the server is the domain name itself, suggesting a lack of legitimate branding or content. Gridinsoft assigns a trust score of 0 out of 100, indicating an absence of credibility.

While the available data confirms the domain’s association with phishing‑related activity, the specific payload, targeted brand, or victim demographic remain undetermined because no page content or campaign artifacts have been disclosed. Defenders should continue to block the domain and its associated IP at network perimeters, add the IP to internal threat‑intel feeds, and monitor the registrar’s name servers for any re‑activation or DNS changes. Ongoing surveillance of the AS42237 range is advisable, as the infrastructure may be repurposed for future malicious campaigns.