krab----5at[.]ru

Analysis of krab----5at.ru shows a high‑risk generic phishing indicator. The domain was registered on March 28, 2026 through RU-CENTER-RU and resolves to IP 185.212.128.10, an OVZ VPS host located in the Netherlands. The site serves content over HTTPS using a Let’s Encrypt certificate (E8) and returns HTTP 200 responses. Cloudflare services are observed, including Browser Insights and HTTP/3 support. Reputation data is poor: Gridinsoft assigns a 0/100 trust score, the domain appears on one security blocklist, and PhishDestroy has already blocked it. VirusTotal scans report six positive detections out of ninety‑four vendors, and AlienVault OTX lists the domain in a single threat pulse. The page title references a Russian paper‑airplane workshop, but no further content analysis is available, making the intended phishing lure unclear. Defenders should immediately block traffic to krab----5at.ru, add the IP address 185.212.128.10 to deny lists, and monitor for any related C2 or credential‑harvesting activity. Ongoing surveillance of the hosting provider and associated IP ranges is advised, as the infrastructure may be reused for additional campaigns.