kra47-cc[.]rituall-vechnost[.]ru

On July 24 2026 analysts examined the domain kra47-cc.rituall-vechnost.ru, which was registered on 19 December 2024 through the Russian registrar REGRU‑RU. The domain resolves to the IPv4 address 193.105.134.30, which is part of ASN 42237 operated by w1n ltd and geographically mapped to Sweden. DNS queries return authoritative nameservers ns1.armadns.com and ns2.armadns.com. No TLS certificate is presented, indicating that the site was served over plain HTTP when it was online. The only visible page title captured before takedown was “kra47 - цифровой архив памяти для CC-историй”, suggesting an attempt to pose as a digital archive for “CC‑stories”.

The infrastructure currently shows an offline status, and the site has been removed from public access. Reputation services flag the domain as high‑risk. Gridinsoft assigns a trust score of 0 out of 100. VirusTotal recorded detections from ten of the ninety‑five scanned vendors, and Google Safe Browsing classifies the URL as a social‑engineering threat. The domain appears on a single external blocklist and is also listed by the PhishDestroy mitigation service.

No SSL fingerprint or certificate transparency data exists, and no additional page content has been released for public analysis. Given the observed indicators, defenders should block traffic to 193.105.134.30 and to the fully‑qualified domain name, enforce DNS sink‑hole rules for ns1.armadns.com and ns2.armadns.com, and monitor for any re‑registration attempts by the same registrar. Continuous observation of the ASN AS42237 range is advisable, as the hosting provider may be reused for future phishing campaigns. Organizations using web filtering should retain the Google Safe Browsing and PhishDestroy classifications to prevent end‑user exposure. The limited public footprint means that attribution remains uncertain, but the combination of a recent registration, low trust score, and multiple vendor detections strongly supports a phishing intent.