5-krab-cc[.]ru

Analysis indicates that 5-krab-cc.ru is currently active and has been classified as a generic phishing site. The domain was registered on 28 March 2026 through the REGRU-RU registrar and resolves to the Cloudflare‑provided address 172.67.132.126, which is located in Canada and is protected by Cloudflare’s CDN and HTTP/3 support. The SSL certificate is issued by Let’s Encrypt (subject E8) and the site returns an HTTP 301 redirect. Technical fingerprints show the presence of Yandex.Metrika, Cloudflare Browser Insights and the Cloudflare edge platform. The domain appears on one external blocklist and has been blocked by the PhishDestroy feed. VirusTotal scans report that five of ninety‑four security vendors flagged the domain, and Gridinsoft assigns a trust score of 0/100. The page title advertised as “Krab5 CC | Мини строительные материалы для творчества и моделирования” does not correspond to any known legitimate service, reinforcing the phishing suspicion. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms because the site content has not been examined. Defenders should prioritize adding 5-krab-cc.ru to deny‑list or firewall rules, monitor outbound connections to the associated Cloudflare IP range, and enforce TLS inspection to capture any malicious POST data. Continuous re‑scanning with multi‑engine services is recommended to capture any changes in detection status. Logging of DNS queries for the domain will aid in early detection of internal attempts to access the site.