kra47cc[.]barbershop-pride[.]ru

The domain kra47cc.barbershop-pride.ru was registered on 24 December 2024 via the REGRU‑RU registrar. DNS resolution points to the IPv4 address 91.236.116.20, which belongs to AS42237 operated by w1n ltd and is geolocated in Sweden. The authoritative name servers are ns1.armadns.com and ns2.armadns.com. No TLS certificate is presented for the host, indicating that HTTPS is not available. A passive HTTP check shows the site is currently taken offline, returning no active service.

Content analysis from the limited snapshot reveals the page title “kra47 – AT платформа для создания персонализированных обучающих курсов”, suggesting the site was positioned as a platform for creating personalized training courses, but no further content has been retrieved. Threat intelligence aggregators have flagged the domain: 14 of 95 VirusTotal scanners label it malicious, Google Safe Browsing classifies it as a social‑engineering threat, and PhishDestroy lists it as blocked. The domain appears on a single security blocklist, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The evidence points to a generic phishing operation that likely leveraged the domain to lure victims into a credential‑stealing workflow, although the exact payload or phishing kit has not been observed. Because the site is offline, active exploitation cannot be confirmed at this time.

However, the combination of registrar data, hosting location, lack of encryption, and multiple security vendor detections warrants a high risk rating. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same IP or name‑server infrastructure, and incorporate the indicator set (domain, IP, ASN) into threat‑intel feeds. Additional scrutiny of traffic to w1n ltd AS42237 may reveal related malicious hosts. Continuous re‑evaluation is advised should the domain return to service.