krab012[.]ru

PhishDestroy confirms krab012.ru is an active credential-harvesting phishing domain at elevated risk. This domain poses a direct threat to user login credentials by masquerading as a legitimate service and prompting victims to enter usernames and passwords.

This domain was registered on February 03, 2026 via RU-CENTER-RU and resolves to IP 172.67.193.53. VirusTotal analysis shows 1 out of 95 security vendors currently flagging the domain. Despite the presence of a Google Trust Services SSL certificate, the combination of recent creation date, low detection rate, and hosting on a shared cloud IP indicates a high probability of malicious intent. The infrastructure lacks established trust scores and shows no evidence of inclusion on major blocklists, suggesting the campaign is either newly deployed or deliberately flying under the radar.

Users should immediately block krab012.ru at the network and browser levels. Avoid any interaction with the domain, including clicking links or entering credentials. Report suspicious emails and domains to your IT security team or through official anti-phishing portals. Organizations are advised to update firewall rules, DNS sinkholes, and endpoint protection signatures using the IP 172.67.193.53 and domain krab012.ru. Continuous monitoring of newly registered .ru domains with similar naming patterns is recommended to prevent follow-on campaigns.