http--krab3--at[.]ru

The domain http--krab3--at.ru was registered on 21 February 2026 and is currently taken offline. DNS resolution points to the IPv4 address 85.192.49.35, which is announced by AS215730 (H2NEXUS LTD) and geolocated to Finland. The host presents an SSL certificate identified only by the fingerprint fragment “E8”, indicating the presence of an HTTPS endpoint. The site’s HTML title is “krab3 cc — Обслуживание автоматических коробок”, suggesting a Russian‑language service description rather than a known commercial brand.

Threat intelligence feeds list the domain on a single security blocklist and it is actively blocked by the PhishDestroy filtering service. VirusTotal scans show that 11 of 93 antivirus and URL‑reputation engines flagged the domain as malicious, reinforcing the suspicion of a phishing‑related operation. No additional contextual data such as registrar information, Safe Browsing verdicts, or open‑source‑intelligence tags were provided. The limited evidence indicates that the infrastructure was used for a generic phishing campaign, but the exact victim lure or credential‑harvesting template remains unknown.

Defenders should add the domain and its resolved IP address to deny‑list rules on perimeter firewalls, proxy servers, and DNS filtering solutions. Continuous monitoring of the ASN AS215730 and any new domains resolving to 85.192.49.35 is recommended, as threat actors frequently reuse hosting resources. Because the site is offline, incident response teams can focus on identifying any recent traffic to the domain within their networks and correlating it with the 11 vendor detections to assess potential compromise. Updating endpoint detection and response (EDR) signatures with the observed SSL fingerprint and page title can improve detection of any re‑hosted copies of the payload.