movementdancecenter[.]ru

The domain movementdancecenter.ru was registered on 17 September 2025 through the Russian registrar REGRU‑RU. Its authoritative nameservers are ns1.regerey.com and ns2.regerey.com. DNS resolution returns the address 193.105.134.30, which belongs to AS42237 (w1n ltd) and is geolocated in Sweden. No TLS certificate is presented, indicating the site was served over plain HTTP. The site’s HTML title, as captured, reads “krab1 - элитный движение танцевальный центр CC премиум‑класса”, suggesting an attempt to portray a premium dance‑center service in Russian. VirusTotal recorded three positive detections out of ninety‑five scanned engines, and the domain appears on a single external blocklist. PhishDestroy has actively blocked the domain, and Gridinsoft assigns it a trust score of 0 / 100. The current operational status is offline, as indicated by the latest collection on 24 July 2026.

Analysis indicates that the infrastructure aligns with a typical generic phishing campaign: a recently created domain, minimal reputation, lack of encryption, and low detection confidence across security vendors. The three positive detections reflect partial consensus among scanning services, while the single blocklist entry, sourced from PhishDestroy, confirms that the domain is recognized as a phishing source. The elevated risk rating therefore warrants heightened vigilance.

Defenders should continue to monitor the IP address 193.105.134.30 for any resurgence or reuse in other campaigns, add the domain to internal block lists, and ensure that email filters reference the known blocklist entry. Because the site is currently offline, active mitigation is limited to preventive controls. Organizations receiving communications that reference “krab1” or claim affiliation with a premium dance‑center should treat such messages as suspicious and verify the sender through out‑of‑band channels.