krab4-cc[.]ru

PhishDestroy identifies krab4-cc.ru as a live generic_phishing landing page specifically designed to harvest cryptocurrency exchange credentials. The infrastructure is brand-new, registered on January 07, 2026, and has already begun luring victims via spoofed emails and social-media posts. While VirusTotal currently shows 2/95 detections, the site is actively serving a fraudulent login overlay that mimics a prominent exchange’s authentication flow, thereby exposing victims to direct financial theft.

This domain was flagged on seed 933961 and is hosted at IP 185.149.120.187 (AS44050). It was registered through REGRU-RU on January 07, 2026, and remains unlisted on all major public blocklists (Google Safe Browsing, PhishTank, OpenPhish, URLVoid). VirusTotal analysis returned 2/95 vendor flags as of last scan, indicating minimal detection coverage at this time. The page title is identical to the domain, a common evasion tactic to bypass keyword filters. No HTTPS certificate is visible, increasing the likelihood of man-in-the-middle interception on any submitted data.

Mitigation begins with strict URL verification: never click shortened links promising “bonus deposits” or “account verification.” Bookmark the legitimate exchange URL and navigate exclusively through that path. If a login prompt appears unexpectedly, close the tab and open the site manually. Enable multi-factor authentication on all crypto accounts and use a hardware key or authenticator app rather than SMS where possible. Report the domain to your email provider and block the IP 185.149.120.187 at the network perimeter. Monitor crypto wallets for unauthorized transfers; if compromised, revoke API keys and initiate the exchange’s incident response immediately.