krab1cc[.]trafic-profi[.]ru

krab1cc.trafic-profi.ru was registered on August 02, 2025 through the REGRU-RU registrar and is currently taken offline. The authoritative nameservers are ns1.regerey.com and ns2.regerey.com. Infrastructure analysis shows the domain resolves to the IPv4 address 193.105.134.30, which belongs to AS42237 w1n ltd and is geolocated in Sweden. No TLS certificate is presented, indicating that the site does not offer encrypted connections.

The page title retrieved before takedown reads “krab1 - мастерская AT-игр для настоящих ролевиков”, which suggests a Russian‑language gaming workshop theme but provides no direct evidence of the phishing content. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the domain, and it is listed on at least one external blocklist. VirusTotal analysis recorded two detections out of ninety‑five scanning engines, confirming that some security products consider the domain malicious.

The lack of an active SSL certificate, the low trust score, and the presence on blocklists collectively indicate a high likelihood of phishing use, consistent with the generic phishing classification. However, because the site is offline, the exact payload, credential‑harvesting mechanisms, and target audience remain unknown. Defenders should continue to deny any connections to 193.105.134.30, add krab1cc.trafic-profi.ru to local and network‑level deny lists, and monitor the IP range for re‑use. Threat‑intel platforms should be updated with the registration details, nameserver information, and the two VirusTotal detections to improve early warning for any future resurrection of the domain or related infrastructure.