kra47at[.]sch8morf[.]ru

The domain kra47at.sch8morf.ru was taken offline prior to this analysis but retains a traceable infrastructure that warrants continued monitoring. Registration data show the domain was created on January 09, 2025 through the REGRU-RU registrar, indicating a relatively recent appearance in the threat landscape. DNS resolution points to the IPv4 address 91.236.116.20, which is assigned to AS42237 w1n ltd and geolocated to Sweden. The domain is served by the armadns.com authoritative name servers (ns1.armadns.com and ns2.armadns.com), a configuration commonly observed in malicious campaigns seeking resilient DNS hosting. No TLS certificate is deployed, meaning any client connection would be unencrypted HTTP, a characteristic that facilitates credential harvesting without the overhead of certificate management.

Reputation services provide mixed signals: five of ninety‑five security vendors on VirusTotal have flagged the domain, and Gridinsoft assigns it a trust score of zero out of one hundred, reflecting a high confidence of malicious use. The domain appears on a single external blocklist and has been specifically blocked by the PhishDestroy service, confirming that at least one commercial mitigation platform has recognized it as hostile. The page title returned from the site, "kra47 - CC-студия автомобильного детейлинга," suggests the site was masquerading as an automotive detailing studio, yet no further content analysis is available.

Given the observed indicators, defenders should add 91.236.116.20 to network‑level deny lists, enforce DNS blocking of kra47at.sch8morf.ru, and monitor for any resurgence of the domain or related subdomains hosted on the same name servers. Continuous re‑scanning with multi‑vendor engines is advised to capture any changes in detection status. While the site is currently offline, the underlying hosting arrangement and registrar remain active, implying the potential for rapid re‑deployment.