crazystorm[.]ru

crazystorm.ru was registered on 03 April 2026 and is presently resolving to the IPv4 address 2.26.76.15, which is hosted by Ace Data Centers II, LLC in the United States. The site presents a Russian‑language title “VPN – Безопасный и быстрый VPN” and serves content over HTTPS using a Let’s Encrypt R12 certificate. An HTTP GET returns a 200 status code, indicating the server is fully operational. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed. Independent analysis on VirusTotal shows that 3 out of 95 scanned security vendors flagged the host as malicious, reflecting a low but non‑zero detection rate. AlienVault OTX references the domain in one threat‑intelligence pulse, confirming its presence in the broader threat‑sharing ecosystem. Risk assessment from the provided data assigns a high risk level and a Gridinsoft trust score of 0/100, reinforcing the conclusion that the site is being used for malicious purposes. The combination of a newly created domain, active TLS certificate, legitimate‑looking VPN branding, and the modest detection footprint suggests a targeted phishing campaign that leverages the VPN narrative to lure victims into credential harvesting. Defenders should add 2.26.76.15 to network‑level deny lists and monitor DNS queries for crazystorm.ru. Email gateways should be configured to flag messages that reference the VPN branding or contain links to the domain. Continuous re‑scanning on VirusTotal and inclusion in internal threat‑intel feeds are recommended to capture any escalation in detection counts. Removal from allow‑lists and proactive URL filtering will reduce exposure while further investigation of the hosting provider may reveal additional malicious assets.