krab2cc--c[.]ru

Analysis of the domain krab2cc--c.ru confirms its classification as a phishing site, specifically designed to target Russian-speaking users under the guise of short-trip planning and weekend route services. The domain, registered on December 23, 2025, through REGRU-RU, currently resolves to the IP address 185.208.158.29, hosted on AS42624 (Global-Data System IT Corporation) in Switzerland. Infrastructure analysis reveals the use of nameservers ns1.reg.ru and ns2.reg.ru, consistent with the registrar's default configuration. The domain lacks an SSL certificate, a common red flag for fraudulent sites, and is currently offline, though its prior operational status was flagged by multiple security mechanisms.

Detection data from VirusTotal indicates that 9 out of 93 security vendors have flagged this domain as malicious, a significant indicator given the low false-positive rate among these vendors. The domain appears on at least one security blocklist, specifically PhishDestroy, and has been assigned a trust score of 0/100 by Gridinsoft, further corroborating its malicious nature. The page title, 'Krab2 cc | Планирование коротких поездок и маршрутов выходного дня,' suggests a localized phishing campaign, potentially leveraging social engineering tactics to deceive users into divulging personal or financial information under the pretext of travel planning services. While the exact content and functionality of the site remain unanalyzed due to its offline status, the combination of technical indicators—absence of SSL, recent registration, low trust scores, and blocklist presence—strongly supports its classification as a phishing domain.

Defenders are advised to treat this domain as compromised and implement blocking measures at the DNS or network level. Organizations should also monitor for any attempts to reuse the associated IP address or registrar infrastructure for future malicious campaigns.