kra---45-----cc[.]ru

This domain, kra---45-----cc.ru, is assessed as a high-risk credential theft phishing site. Analysis indicates the infrastructure is designed to harvest login credentials under the guise of a design materials service, as evidenced by the page title 'Kra45 — центр прикладного дизайна и материалов CC версия.' The threat specifically targets users seeking design resources, tricking them into entering sensitive information on fraudulent login forms. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 17 out of 95 security vendors on VirusTotal, appears on one security blocklist, and is currently offline. It was registered through REGRU-RU on November 16, 2025, and resolves to the IP address 193.105.134.21, hosted in Sweden under AS42237 (w1n ltd). The domain lacks an SSL certificate, further increasing its risk profile. Google Safe Browsing has explicitly flagged it as phishing, and it was blocked by at least one security entity. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP (193.105.134.21) at the network perimeter. Organizations should deploy endpoint protection rules to detect and prevent access to unencrypted credential submission forms, particularly those mimicking design or creative service portals. Security teams are advised to monitor for unusual authentication attempts from internal IPs that may have interacted with the domain prior to its takedown. User awareness training should emphasize the risks of entering credentials on unencrypted sites, especially those with recently registered domains or lacking SSL certificates. Additionally, log analysis should focus on any prior connections to 193.105.134.21 or domains registered through REGRU-RU during the November 2025 timeframe.