krab-1cc[.]ru

The domain krab-1cc.ru was registered on 13 December 2025 through the REGRU‑RU registrar. Its authoritative nameservers are imani.ns.cloudflare.com (listed twice) and jakub.ns.cloudflare.com, indicating the use of Cloudflare DNS services. The site resolves to the IPv4 address 91.236.116.113, which is allocated to AS42237 (w1n ltd) and geolocated to Sweden. No TLS certificate is presented for the host, meaning the site is reachable only over HTTP. The page title returned from the live host before it was taken offline reads “krab1.cc — кроссовки для игры и игры | Официальный сайт”, suggesting a Russian‑language offering of sneakers for gaming, but no further content analysis is available.

Reputation services assign a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist. It has also been flagged by the PhishDestroy blocking service. VirusTotal analysis shows that three of ninety‑three scanning engines reported a detection, reinforcing the malicious classification. The overall risk rating is elevated, and the threat type is identified as generic phishing.

Given the combination of a recent registration, lack of encryption, low trust score, presence on blocklists, and multiple vendor detections, the infrastructure appears to have been purpose‑built for phishing. The offline status indicates that the site is no longer actively serving content, but the underlying IP address and DNS configuration remain under the control of the same operator. Defenders should continue to block the domain and its associated IP at perimeter filters, monitor for any re‑activation or reuse of the same IP range, and update any URL‑allow lists that may inadvertently permit traffic to this host. Additional investigation of the Cloudflare nameservers could reveal other domains sharing the same infrastructure, and threat‑intel sharing platforms should be updated with the observed indicators to aid broader detection.