kra46-cc[.]fingra7[.]ru

The domain kra46-cc.fingra7.ru was registered on 11 December 2024 through the REGRU‑RU registrar. Its authoritative name servers are ns1.armadns.icu and ns2.armadns.icu, and it resolves to the IPv4 address 193.105.134.30, which belongs to AS42237 operated by w1n ltd in Sweden. No TLS certificate is presented, indicating the site was served over plain HTTP only. The only visible page title returned by the server is “kra46 – графический AT дизайн нового поколения”, which does not reveal a direct brand target but suggests a generic design‑related theme.

Google Safe Browsing categorises the URL as social engineering, and the site is listed on a single external security blocklist. VirusTotal reports that seven of ninety‑five scanning engines flagged the domain as malicious, confirming the presence of at least one detection signature. Independent phishing mitigation service PhishDestroy also reports the domain as blocked, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting a lack of credibility. The overall threat rating is elevated, and the current operational status is offline, meaning active content is no longer reachable at the time of analysis.

Nevertheless, the recorded infrastructure—particularly the use of the armadns.icu name‑server pair and the Swedish hosting ASN—matches patterns observed in other phishing campaigns that exploit low‑cost or compromised hosting. Defenders should continue to block the domain at perimeter and DNS filtering layers, add the IP address 193.105.134.30 to threat‑intel feeds, and monitor for any re‑registration attempts under the same second‑level domain or similar name‑server configurations. Ongoing vigilance is advised because the lack of SSL and the generic page title indicate that the site could be rapidly re‑hosted with minimal changes to continue targeting victims.