krab5-5cc[.]ru

Analysis indicates that the fully qualified domain krab5-5cc.ru was registered on 12 March 2026 via the REGRU‑RU registrar and is hosted on Cloudflare infrastructure, as evidenced by the authoritative nameservers sureena.ns.cloudflare.com and woz.ns.cloudflare.com and the A‑record pointing to 188.114.97.3. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal scans show that two of ninety‑one AV engines currently flag the domain as malicious, confirming that at least a subset of detection products consider it a phishing threat.

No additional context such as page title, SSL certificate details, or HTTP response codes is available, limiting the ability to describe the exact payload or targeted brand. The lack of public page content suggests that the site may be transient or that automated crawlers have not retrieved it. The shared Cloudflare IP means that network‑level blocking of the address could impact unrelated legitimate services, so defenders should prefer DNS‑ or URL‑based filtering.

Recommendations include adding krab5-5cc.ru to internal blocklists, monitoring DNS queries for the domain and its Cloudflare nameservers, and correlating any credential‑submission events with the two vendor detections. Continuous re‑evaluation is advised, as the domain’s short age and recent appearance on blocklists indicate an active campaign that could evolve or spawn additional infrastructure.