kra46-at[.]hram-tatiana[.]ru

Analysis of the domain kra46-at.hram-tatiana.ru indicates it was a phishing site impersonating a cultural or historical portal, as suggested by its page title 'kra46 - AT культурно-исторический портал.' The domain was registered on December 10, 2024, through the registrar REGRU-RU. Infrastructure analysis reveals it resolved to the IP address 193.105.134.30, hosted on AS42237 (w1n ltd) in Sweden. The domain utilized nameservers ns1.armadns.icu and ns2.armadns.icu, a configuration often associated with malicious infrastructure. No SSL certificate was detected, increasing the likelihood of interception of unencrypted traffic.

At the time of assessment, the domain appeared on one security blocklist and was flagged by one of 95 security vendors on VirusTotal, specifically PhishDestroy. Gridinsoft assigned a trust score of 0/100, further indicating its malicious nature. The domain has since been taken offline, though residual DNS records or cached content may persist.

Defenders should monitor for related domains registered through REGRU-RU or resolving to the same IP range, particularly those using the armadns.icu nameservers. Given the limited detection data, additional scrutiny of the hosting provider AS42237 may be warranted to identify other potentially compromised or malicious domains. The exact content and phishing mechanics of the site remain unanalyzed, but the available evidence supports its classification as a generic phishing domain targeting users of cultural or historical portals.