krab1at[.]stroy42[.]ru

Analysis dated July 24 2026 identifies the domain krab1at.stroy42.ru as a high‑risk generic phishing infrastructure that has been taken offline. The site presented the page title “krab1 – AT помощник для рыболовов‑любителей”. DNS resolution points to the IPv4 address 193.105.134.30, which belongs to the AS42237 network operated by w1n ltd and is geolocated in Sweden. The domain’s authoritative name servers are ns1.regerey.com and ns2.regerey.com, and registration was performed through the REGRU‑RU registrar on 6 March 2025. No TLS certificate was observed, indicating the site was served only over HTTP.

Google Safe Browsing classifies the URL as social engineering, and the domain appears on a single security blocklist. Independent scanning on VirusTotal recorded 12 detections out of 95 participating vendors, confirming malicious intent. Gridinsoft assigned a trust score of 0 out of 100, and PhishDestroy lists the domain as blocked. The available evidence establishes a clear phishing intent, but the specific target audience or credential‑harvesting mechanism remains undocumented beyond the generic page title. No additional indicators such as malware payload hashes, command‑and‑control endpoints, or phishing kit signatures have been disclosed.

Consequently, the full scope of the campaign, including potential victims and the extent of credential compromise, cannot be fully determined at this time. Defenders should continue to block resolution of krab1at.stroy42.ru at the network perimeter and update intrusion‑prevention signatures to include the observed IP address 193.105.134.30 and the associated name servers. Monitoring for any resurgence of the domain or reuse of the same hosting infrastructure is advised. Organizations using Google Safe Browsing or similar reputation services should ensure the domain is flagged as malicious to prevent user access.