kra------45---cc[.]ru

On July 23, 2026, the domain kra------45---cc.ru was observed to be offline. The domain was registered on 18 November 2025 through the Russian registrar REGRU‑RU and is delegated to the authoritative name servers ns1.reg.ru and ns2.reg.ru. DNS resolution points to the IPv4 address 193.105.134.21, which belongs to the autonomous system AS42237 operated by w1n ltd and is geolocated in Sweden. No TLS certificate is presented for the host, indicating that the site was served only over HTTP, which limits the ability of network‑based TLS inspection to capture encrypted payloads. Google Safe Browsing classifies the domain as a social‑engineering threat, and the page title returned from the last known HTTP response reads “Kra45 — кинокаталог премьеров и редких фильмов CC версия”, suggesting an attempt to masquerade as a Russian‑language film catalogue.

VirusTotal records indicate that 12 out of 95 scanning engines returned a positive detection, reinforcing the malicious intent implied by the Safe Browsing flag. The Gridinsoft trust score is recorded as 0 out of 100, and the domain appears on a single external blocklist, currently enforced by the PhishDestroy service, which has already blocked traffic to the host. The available intelligence does not provide details on the specific phishing payload, credential‑capture mechanisms, or any associated command‑and‑control infrastructure. Consequently, the exact tactics, techniques, and procedures (TTPs) employed by the actors behind kra------45---cc.ru remain unknown. Nevertheless, the combination of a recent registration date, lack of TLS, negative reputation scores, and the presence on a phishing‑oriented blocklist suggests an active or recently decommissioned phishing campaign targeting users searching for film content.

Defenders should add the fully qualified domain name and its resolved IP address to network‑level deny lists and ensure that web‑proxy or DNS filtering solutions flag any resolution attempts.