kra45-at-1[.]ru

Analysis of kra45-at-1.ru indicates a high‑confidence phishing indicator set. The domain was created on November 28, 2025 and is registered through REGRU-RU, using the Russian registrar reg.ru. It resolves to IP address 198.18.1.36 and is served by the authoritative name servers ns1.reg.ru and ns2.reg.ru. No SSL certificate is present, meaning the site operates only over HTTP, which is typical for many low‑cost phishing deployments. The page title returned by the server is the literal string "kra45-at-1.ru," providing no additional context about the intended victim or lure.

Gridinsoft assigns the domain a trust score of 0 out of 100, indicating a complete lack of reputation. VirusTotal reports that 11 of 95 scanned security vendors flag the domain, confirming that a notable minority of scanners detect malicious behavior. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, demonstrating that at least one dedicated anti‑phishing platform has taken action against it. AlienVault OTX lists the domain in one threat‑intel pulse, further corroborating its malicious classification.

Current operational status is offline, suggesting that the hosting has been taken down or the site is no longer serving content. Defenders should continue to block the domain at perimeter filters, DNS resolvers, and endpoint web controls, and should monitor the associated IP 198.18.1.36 for any re‑use in future campaigns. Because the site is already offline, incident response can focus on identifying any compromised credentials or phishing emails that referenced this domain, and on ensuring that users are aware that any links to kra45-at-1.ru are malicious. Ongoing vigilance is recommended, as the lack of SSL and recent registration date are typical of fast‑flux or low‑cost phishing infrastructure that may be repurposed quickly.