kra46cc[.]ya-realtor[.]ru

Analysis of kra46cc.ya-realtor.ru shows a short‑lived domain created on December 05 2024 and registered through the Russian registrar REGRU‑RU. The site resolves to the IPv4 address 193.105.134.30, which is allocated to AS42237 operated by w1n ltd in Sweden. No TLS certificate is presented, indicating the service is delivered over plain HTTP only. The page title returned from the live host before takedown was "kra46 - AT подход к умному управлению недвижимостью," a Russian phrase that translates to a smart property‑management approach, suggesting the site was crafted to mimic a legitimate real‑estate management portal.

The domain has been blocked by PhishDestroy and appears on a single external security blocklist, reinforcing its classification as a phishing resource. Reputation scoring from Gridinsoft assigns a trust score of 0 / 100, and a VirusTotal scan recorded three positive detections out of ninety‑five scanners, confirming that multiple security engines flag the domain as malicious. Nameserver configuration uses ns1.regerey.com and ns2.regerey.com, which are not commonly associated with reputable hosting providers. Current operational status is offline, indicating the hosting has been taken down, but the infrastructure details remain useful for threat‑intel correlation.

Defenders should add the domain and its associated IP address to internal blocklists, monitor for any future re‑use of the same nameservers or ASN, and ensure that web‑filtering solutions reference the observed blocklist entries. Because the site employed no SSL, any credential capture would have occurred in clear text, so organizations should audit logs for any outbound connections to the IP during the active window. Continuous watch for new registrations that reuse the same registrar or naming pattern is advised, as the threat actor may attempt to resurrect the campaign under a different domain.