www1[.]kra--43-------at[.]ru

The domain www1.kra--43-------at.ru is a generic phishing site designed to deceive users into disclosing sensitive information. It does not impersonate a specific brand or employ a known crypto drainer kit. As of the latest verification, www1.kra--43-------at.ru has been taken offline, though it previously posed an elevated risk for credential theft or other fraudulent activities.

Technical indicators confirm the domain's malicious intent. Three of 95 VirusTotal security vendors flagged www1.kra--43-------at.ru, including Fortinet, Seclookup, and SOCRadar. It appears on one security blocklist (PhishDestroy) and is registered through RU-CENTER-RU, with a creation date of October 28, 2025. The domain resolves to IP address 91.236.116.20, hosted in Sweden under AS42237 (w1n ltd), and lacks an SSL certificate. The observed page title was 'kra44 - эталон профессионализма AT в рекламном проектировании', and nameservers are ns1.armadns.com and ns2.armadns.com.

Users who interacted with www1.kra--43-------at.ru should immediately change any credentials entered on the site, enable two-factor authentication (2FA) on affected accounts, and monitor for unauthorized transactions or identity fraud. Report the domain to local cybersecurity authorities or platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in takedown efforts. If financial or crypto accounts were exposed, contact the respective institutions for additional security measures.