krab-5------cc[.]ru

Analysis of the domain krab-5------cc.ru indicates it is an active phishing site targeting Russian-speaking users under the guise of a construction equipment rental service. The domain, registered on March 28, 2026, through RU-CENTER-RU, resolves to the IP address 185.212.128.10. The page title, "KRAB5.CC - Аренда строительных лесов в Москве | KRAB5 это надежное оборудование," suggests a fraudulent operation posing as a legitimate scaffolding rental business in Moscow. However, no further technical details about the phishing kit, payload delivery mechanisms, or specific brand impersonation have been confirmed beyond the page title. Security vendors have flagged this domain inconsistently: 4 out of 95 engines on VirusTotal detected malicious activity, while Gridinsoft assigned a trust score of 0/100. The domain appears on two security blocklists and has been included in 22 threat intelligence pulses on AlienVault OTX, indicating broader recognition of its malicious nature. It is currently blocked by at least two security systems, PhishDestroy and BLP-Malware, and remains active as of July 12, 2026. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Given the lack of confirmed details about the phishing kit or payload, further investigation into associated IP addresses, WHOIS records, and historical DNS resolutions is recommended to identify related infrastructure. No evidence currently links this domain to a specific phishing campaign beyond its generic classification as a phishing site.