kra46-at[.]ideltower[.]ru

Analysis of the domain kra46-at.ideltower.ru indicates it was actively flagged as a credential phishing site prior to being taken offline on or before July 24, 2026. The domain was registered on December 11, 2024, through REGRU-RU, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolved to the IP address 193.105.134.30, hosted on AS42237 (w1n ltd) in Sweden, a network segment previously observed in phishing and malware distribution campaigns. Nameservers ns1.armadns.icu and ns2.armadns.icu were configured, both linked to bulletproof or low-reputation DNS providers commonly exploited by threat actors. At the time of assessment, the domain appeared on one security blocklist (PhishDestroy) and was assigned a trust score of 0/100 by Gridinsoft, reflecting high-risk classification.

Twelve of ninety-five security vendors on VirusTotal flagged the domain as malicious, though the specific detection logic or payload analysis is not publicly documented. No SSL certificate was present, increasing the likelihood of interception or manipulation of user-submitted data. The page title, matching the domain name itself (kra46-at.ideltower.ru), provides no clear indication of a targeted brand or service, suggesting either a generic credential harvesting template or an unbranded phishing kit. The domain's current status is offline, though historical resolution and detection data remain relevant for retrospective threat hunting.

Defenders should treat any prior interaction with this domain as a potential compromise event, particularly if credentials or session tokens were entered. Network security teams are advised to block the IP 193.105.134.30 and monitor for connections to the nameservers ns1.armadns.icu and ns2.armadns.icu. Given the registrar's history and the hosting provider's reputation, similar domains may emerge; proactive monitoring of newly registered domains under REGRU-RU or resolving to AS42237 is recommended.