kra46[.]oka-nn[.]ru

Analysis of the domain kra46.oka-nn.ru indicates it was registered on December 11, 2024, through REGRU-RU and is associated with generic phishing activity targeting Russian-speaking users. The domain resolves to IP address 193.105.134.30, hosted on AS42237 (w1n ltd) in Sweden, an infrastructure frequently observed in phishing campaigns. No SSL certificate is present, increasing the risk of credential interception or data exposure during transmission. The domain's nameservers, ns1.armadns.icu and ns2.armadns.icu, are linked to other malicious domains, further suggesting coordinated abuse.

The page title, 'kra46 - экологический мониторинг AT водных ресурсов в реальном времени' (translated: 'kra46 - ecological monitoring of water resources in real time'), implies a focus on environmental or governmental themes, which may be used to lend credibility to phishing attempts. While the exact content of the site remains unanalyzed, the title suggests an attempt to mimic legitimate monitoring services, potentially targeting organizations or individuals involved in water resource management. Security vendors have flagged the domain, with 3 of 95 engines on VirusTotal detecting it as malicious. It is also blocked by PhishDestroy and appears on at least one security blocklist.

The domain currently returns an offline status, though this does not preclude future reactivation. Defenders should treat this domain as high-risk and consider blocking it at the DNS or firewall level, particularly in environments where Russian-language phishing or environmental-themed scams pose a threat. Monitoring for related infrastructure, such as the hosting provider or nameservers, is recommended to identify emerging threats.