kra46-cc[.]sr-info[.]ru

The domain kra46-cc.sr-info.ru was registered on 11 December 2024 through the REGRU‑RU registrar and currently resolves to the IPv4 address 193.105.134.30, which is allocated to an AS42237 network operated by w1n ltd in Sweden. No SSL certificate is presented for the host, indicating that any data exchanged with the site would be transmitted over plain HTTP. The site’s HTML title reads “kra46 – информационный CC‑портал для бизнеса”, but no further content analysis is available because the service has been taken offline. Reputation services flag the domain as highly untrusted: Gridinsoft assigns a trust score of 0 out of 100, Google Safe Browsing classifies it as a social‑engineering threat, and PhishDestroy lists it as blocked.

VirusTotal reports ten detections out of ninety‑five scanned engines, confirming that multiple security vendors have identified malicious behavior. The domain appears on at least one public blocklist and is served by the nameservers ns1.armadns.icu and ns2.armadns.icu, which are commonly associated with fast‑flux or abuse‑prone hosting. The combination of a recent registration, lack of TLS, low trust score, multiple vendor detections, and blocklist inclusion strongly suggests that the domain was used for a generic phishing campaign targeting Russian‑language business users.

Because the site is already offline, immediate mitigation focuses on preventing future resolution attempts. Defenders should add the domain and its resolving IP to local deny‑lists, monitor DNS queries for similar .ru or .info sub‑domains, and consider enforcing strict TLS‑only policies to block non‑encrypted connections. Continuous observation of the associated nameservers and the AS42237 network is recommended, as they may host additional malicious actors.