kra------43--cc[.]ru

Analysis as of July 24, 2026 indicates that the domain kra------43--cc.ru is currently offline but exhibits multiple indicators of a high‑risk phishing infrastructure. The domain was registered on November 19, 2025 through the Russian registrar REGRU‑RU and uses the default reg.ru nameservers (ns1.reg.ru, ns2.reg.ru). DNS resolution points to IP 193.105.134.21, which is assigned to AS42237 operated by w1n ltd in Sweden. No TLS certificate is presented, meaning the site served HTTP only. The page title retrieved during the brief online window reads “Kra43 — ароматерапия, спокойствие и домашние ароматы CC версия”, suggesting a masquerade of an aromatherapy related service, though the content has not been further examined.

Threat intelligence feeds flag the domain on one security blocklist and Google Safe Browsing classifies it as a social‑engineering threat. VirusTotal scans show 15 of 95 AV engines flagging the domain, reinforcing the malicious assessment. The Gridinsoft trust score is 0/100, indicating no trust. PhishDestroy has already added the domain to its block list.

Given the combination of registrar characteristics, the hosting ASN, lack of encryption, and the multiple vendor detections, the infrastructure aligns with known generic phishing operations. However, the exact payload, credential‑stealing mechanisms, and target audience remain unverified because the site is no longer reachable. Defenders should block the domain at the DNS and proxy layers, monitor for any future re‑use of the IP address 193.105.134.21, and incorporate the observed indicators (page title, IP, ASN, registrar) into threat‑intel feeds. Continuous re‑evaluation is advised in case the domain becomes active again.