kra46-at[.]sv-msk[.]ru

Analysis of the domain kra46-at.sv-msk.ru, created on 10 December 2024, indicates that it was used in a generic phishing operation and is currently offline. The domain resolves to the IPv4 address 193.105.134.30, which belongs to AS42237 operated by w1n ltd and is geolocated in Sweden. No TLS certificate is presented, meaning the site was served over plain HTTP. The registrar listed as REGRU‑RU and the authoritative nameservers ns1.armadns.icu and ns2.armadns.icu are typical of fast‑flux or disposable hosting services.

Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal records show that one out of ninety‑five scanning engines flagged the domain, confirming at least one detection of malicious behavior. The domain appears on a single public blocklist and has been added to the PhishDestroy blocklist, which indicates that security vendors have taken active mitigation steps. The page title observed before takedown reads “kra46 – AT управление светотехническими решениями в Москве,” suggesting an attempt to masquerade as a Russian lighting‑solutions provider, but the content of the site has not been captured for further analysis.

Uncertainty remains regarding the exact phishing payload, the targeted victims, and whether additional infrastructure such as command‑and‑control servers or credential‑harvesting forms was associated with the domain. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the associated IP and nameservers, and ensure that any email communications referencing the “AT управление светотехническими решениями” brand are scrutinized. Ongoing threat‑intel feeds should be consulted for potential re‑use of the IP address or naming patterns, and incident response teams should treat any compromise reports involving this domain as high priority due to the elevated risk rating.