kra----36---------cc[.]ru

On July 25, 2026, investigators reviewed the domain kra----36---------cc.ru, which is currently offline. The domain was registered on August 7, 2025 through the REGRU-RU registrar and is hosted on the IP address 193.105.134.30, an address allocated to AS42237 w1n ltd in Sweden. No TLS certificate was observed for the site, indicating that any traffic would have been transmitted over plain HTTP. The authoritative name servers are ns1.regerey.com and ns2.regerey.com. The page title returned by the server, “kra46 - фабрика антигравитации”, suggests a Russian‑language landing page, but no further content analysis is available.

The domain appears on a single security blocklist and has been blocked by the PhishDestroy service. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. Google Safe Browsing categorizes the site under social engineering, and VirusTotal reported that 16 of 95 scanned security vendors flagged the domain as malicious. These independent detections converge on a classification of generic phishing.

The evidence does not disclose the specific phishing kit or targeted brand, and the offline status prevents real‑time validation of the payload. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP and name servers, and consider adding the IP to internal deny lists. Since the site lacks SSL, any future re‑activation would be trivially observable in network logs. Ongoing vigilance is advised, especially for users who may encounter similar Russian‑language phishing constructs.