kra46at[.]samaraharry[.]ru

Analysis indicates that the domain kra46at.samaraharry.ru was registered on December 10, 2024 through the REGRU-RU registrar. VirusTotal records show that nine of ninety‑five scanning engines flagged the domain as malicious, confirming a phishing classification. The site’s page title, “kra46 - AT портал для фанатов Гарри Поттера в Самаре”, suggests an attempt to lure Russian‑speaking users interested in Harry Potter fan content. No TLS certificate is present, meaning all traffic would be unencrypted. The domain resolves to 193.105.134.30, an address located in Sweden and announced by AS42237 w1n ltd.

Nameserver delegation to ns1.armadns.icu and ns2.armadns.icu is consistent with infrastructure often used for fast‑flux or disposable hosting. Gridinsoft assigned a trust score of 0 out of 100, and the domain is listed on a single public security blocklist. PhishDestroy has actively blocked the domain, and its current status is offline, limiting immediate exploitation but leaving the underlying infrastructure reusable. Uncertainty remains regarding the exact content served before takedown, as no detailed page capture is available.

The lack of SSL, low trust score, and multiple vendor detections suggest a high likelihood of credential‑stealing activity. Defenders should add both the domain and its resolved IP address to network‑level deny lists, monitor the associated nameservers for future registrations, and retain the indicator set for correlation with any re‑appearance. Continuous observation of AS42237 traffic is advised, as the same host may be repurposed for additional phishing campaigns. Integrating the VirusTotal detection count and blocklist information into SIEM rules will improve early detection of related infrastructure.