kra47at[.]ermilovs-company[.]ru

PhishDestroy has identified kra47at.ermilovs-company.ru as a generic phishing domain with an elevated risk level, now confirmed offline. This domain impersonated a health marathon under the title 'krab1 - марафон здоровья AT для всей семьи', likely aiming to harvest personal information or credentials from visitors. The domain was created on February 21, 2026, and resolved to IP address 193.105.134.30, with an SSL certificate from R12.

Technical analysis reveals significant red flags: VirusTotal shows 10 out of 95 security vendors flagging this domain as malicious, and it appears on one security blocklist. The domain's unique seed 78d21b was used to track this campaign. Despite being offline, the infrastructure remains a concern, as the IP and associated certificates could be reused for similar attacks.

Currently, the domain is no longer accessible, which limits immediate risk. However, users who previously visited the site should monitor for suspicious activity and change any credentials entered. PhishDestroy recommends blocking the domain and IP at the network level, and educating users to verify URLs before submitting personal data. Continued vigilance is advised as threat actors may pivot to new domains with similar patterns.