krab2cc[.]zagatovkin[.]ru

On July 24 2026, the domain krab2cc.zagatovkin.ru was observed as part of a high‑risk generic phishing campaign. The site was provisioned on 2 August 2025 and resolves to the IPv4 address 193.105.134.30, which belongs to AS42237 operated by w1n ltd and is geolocated in Sweden. No TLS certificate was presented, indicating HTTP‑only service. The page title returned by the server, “krab2 - воплощает муниципалитет СС уровня”, suggests the content attempts to portray a municipal‑level service, although the exact target of impersonation cannot be confirmed from the available data. Google Safe Browsing classified the domain under social engineering, and the domain appears on one security blocklist that is currently enforced by PhishDestroy.

Independent analysis on VirusTotal showed that ten out of ninety‑five scanners flagged the domain as malicious, reinforcing the suspicion of phishing activity. Additional reputation signals are extremely poor: Gridinsoft assigned a trust score of 0 out of 100, and the domain is listed with a registrar identified as REGRU‑RU. The authoritative nameservers are ns1.regerey.com and ns2.regerey.com. As of the reporting date the hosting appears to be taken offline, but the infrastructure components remain visible and could be re‑activated.

Defenders should immediately add the domain and its resolved IP address to deny‑list rules on perimeter and endpoint controls, monitor DNS queries for the associated nameservers, and consider watching the registrar for any rapid re‑registration activity. Because the site currently lacks HTTPS, any future re‑deployment would be trivially detectable through missing certificate validation. Continuous threat‑intel feeds that reference the same IP or ASN should be correlated to detect possible resurgence. Until further evidence emerges, the domain should be treated as a confirmed high‑risk phishing indicator.