www-krb2-cc[.]ru

The domain www-krb2-cc.ru is a generic phishing site designed to harvest user credentials through fraudulent login pages. It does not impersonate a specific brand or employ a known crypto drainer kit. As of the latest verification, www-krb2-cc.ru has been taken offline, though it previously posed an elevated risk for credential theft.

Technical indicators confirm the domain's malicious intent. www-krb2-cc.ru was flagged by 3 of 95 security vendors on VirusTotal, including Gridinsoft, Seclookup, and SOCRadar, with a Gridinsoft trust score of 0/100. It appeared on one security blocklist (PhishDestroy) and was registered through DOMENUS-RU on December 20, 2025. The domain resolved to IP address 193.105.134.70, hosted by AS42237 (w1n ltd) in Sweden, with no SSL certificate available. The observed page title was 'KRAB2CC Авторизация на сайте', and the site returned an HTTP 429 status. Nameservers were bryce.ns.cloudflare.com and rachel.ns.cloudflare.com.

Users who interacted with www-krb2-cc.ru should immediately change any credentials entered on the site, particularly if reused across other platforms. Enable two-factor authentication (2FA) on all accounts to mitigate further risk. Monitor financial and personal accounts for unauthorized activity. Report the domain to relevant authorities, such as local cybercrime units or platforms like Google Safe Browsing or PhishTank, to aid in broader takedown efforts.