kra46at[.]edusibiri[.]ru

The domain kra46at.edusibiri.ru was registered on December 01, 2024 through the REGRU-RU registrar and is currently resolved to the IPv4 address 193.105.134.30. The host resides in Sweden and is announced by AS42237 w1n ltd. No TLS certificate is presented, indicating that the site was accessed over plain HTTP only. The authoritative nameservers are ns1.regerey.com and ns2.regerey.com. The page title returned by the server reads "kra46 - AT образовательная платформа нового поколения", which suggests the site is positioned as an educational platform, although no further content analysis is available.

VirusTotal scans show that five of ninety‑five participating security vendors flagged the domain as malicious, providing modest but notable detection confidence. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service. Independent reputation scoring from Gridinsoft assigns the domain a trust score of 0 out of 100, reinforcing its classification as high‑risk. The site is presently taken offline, which limits immediate exposure but does not remove the underlying infrastructure.

Defenders should continue to enforce DNS‑level blocks for kra46at.edusibiri.ru and the associated IP address 193.105.134.30, incorporate the domain into URL filtering policies, and monitor the registrar and nameserver records for any rapid changes that could indicate re‑use. Additional scrutiny of traffic to the AS42237 network is advisable, as the hosting provider may be leveraged for other malicious activities. Because the site lacks HTTPS, any future re‑activation would be trivially intercepted, allowing network‑level remediation. Continuous re‑evaluation of VirusTotal and other multi‑vendor scans is recommended to capture any new detections that may emerge as threat actors evolve their payloads.