krab5c-cc[.]ru

krab5c-cc.ru is currently listed as an active generic phishing site. The domain was registered on 5 February 2026 through the REGRU-RU registrar and is hosted on the IP address 104.21.1.244, which is served by Cloudflare as indicated by the nameservers roxy.ns.cloudflare.com and yevgen.ns.cloudflare.com. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy service.

VirusTotal submitted the domain to 91 scanning engines, of which four reported malicious activity, confirming a non‑trivial detection rate. No additional intelligence such as SSL certificate details, HTTP response codes, or page title has been disclosed, leaving the exact content of the landing page unverified. The limited detection footprint suggests that the phishing infrastructure is relatively new, consistent with the February creation date, and that automated scanners have only partially identified the threat.

Defenders should add 104.21.1.244 to network‑level deny lists, enforce DNS filtering for krab5c-cc.ru, and monitor for any related Cloudflare‑based subdomains. Continuous re‑scanning on VirusTotal and inclusion in email and web gateway threat feeds are recommended to capture any future escalation. Given the active status and confirmed detections, the risk posture remains elevated until the domain is fully takedown or its hosting infrastructure is neutralized.