krab1at[.]zamerproff[.]ru

The domain krab1at.zamerproff.ru was registered on August 02, 2025 through the REGRU-RU registrar and is currently taken offline. DNS resolution points to the IPv4 address 193.105.134.30, which belongs to AS42237 w1n ltd and is geolocated in Sweden. The authoritative name servers are ns1.regerey.com and ns2.regerey.com. No TLS certificate is presented for the host, indicating that the site operated without HTTPS protection. The page title observed during the brief analysis reads "krab1 - AT производство строп для промышленности УрФО," suggesting the site attempted to pose as a Russian industrial rope‑manufacturing entity.

Google Safe Browsing classifies the URL as a social engineering threat, and the domain is listed on a single security blocklist. PhishDestroy has also flagged the domain as malicious. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence in its malicious nature. VirusTotal reports that eight of ninety‑five scanned security vendors identified the domain as malicious, providing independent confirmation of its threat profile.

The evidence indicates a generic phishing campaign targeting users with a fabricated industrial service front. Uncertainty remains regarding the specific phishing kit or payload used, as no further content analysis is available. Defenders should ensure the domain and its associated IP address are blocked at network perimeter devices, update URL filtering feeds with the observed indicators, and monitor the registrar and name server infrastructure for any re‑registration attempts. Continuous observation of the AS42237 block for related activity is recommended, as adversaries may reuse the hosting environment for future campaigns.