krab1-cc[.]jeans-odejda[.]ru

This domain, krab1-cc.jeans-odejda.ru, is flagged as a credential theft operation impersonating legitimate AT research platforms. The page title "krab1 - AT исследовательская платформа для анализа данных" suggests an attempt to deceive users into believing they are accessing an authentic data analysis tool, likely targeting researchers, academics, or corporate employees with access to sensitive datasets. The domain’s infrastructure is designed to harvest login credentials, potentially leading to unauthorized access to proprietary or confidential information systems. Analysis indicates the domain was registered on March 07, 2025, through REGRU-RU, a registrar frequently associated with malicious activity. It resolves to the IP address 193.105.134.30 and is currently flagged by 4 out of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist, and its Gridinsoft trust score is 0/100, further confirming its malicious nature. The combination of recent registration, low detection but consistent flagging by security tools, and the use of a Russian registrar suggests a targeted campaign with elevated risk. Users who visited krab1-cc.jeans-odejda.ru should immediately revoke any credentials entered on the site, particularly if they were reused across other platforms. Monitor accounts linked to the compromised credentials for unauthorized access or anomalous activity. If corporate or institutional credentials were exposed, report the incident to the relevant IT or security team for further investigation. Additionally, scan the device used to access the domain for malware, as credential theft sites often deploy secondary payloads. Block the domain and its associated IP (193.105.134.30) at the network level to prevent further exposure.