krab1at[.]avtoreal29ru[.]ru

The domain krab1at.avtoreal29ru.ru was observed resolving to the IPv4 address 193.105.134.30, which is registered to AS42237 w1n ltd and geolocated in Sweden. Registration data shows the domain was created on 2025-03-06 through the REGRU-RU registrar, and its authoritative name servers are ns1.regerey.com and ns2.regerey.com. No TLS certificate was presented for the host, indicating that the site operated only over HTTP. Google Safe Browsing classifies the URL as a social engineering threat, and VirusTotal reports that 11 of 95 scanned security engines flagged the domain as malicious.

The domain appears on a single public blocklist and is actively blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the perception of high risk. The only publicly visible attribute is the page title "krab1 - CC галерея современного искусства Оксаны Макаевой," which suggests an attempt to masquerade as a contemporary art gallery, but no additional content analysis is available. The site was taken offline prior to the report date of 2026-07-24, and no further HTTP response details were captured.

Analysts should treat the domain as a high‑risk phishing indicator: block the host and its associated IP at perimeter defenses, add the domain to internal threat intelligence feeds, and monitor for any re‑use of the IP or name‑server infrastructure in future campaigns. Because the site lacked HTTPS, any credential harvesting would have occurred over clear‑text channels, increasing exposure to network‑level interception. Defenders are advised to verify that existing URL filtering solutions reference the identified blocklist entry and to review logs for prior connections to 193.105.134.30. Until additional payload or landing‑page details emerge, the primary mitigation focus remains on denying access to the domain and its hosting infrastructure.