kra47-at[.]r-g-k[.]ru

Analysis on July 22, 2026 indicates that the domain kra47-at.r-g-k.ru is currently offline, which limits real-time observation of its content. The domain was registered on 13 January 2025 through the Russian registrar REGRU-RU and is delegated to the Armadns nameservers ns1.armadns.com and ns2.armadns.com. No SSL certificate is present, meaning any attempted HTTP connection would be unencrypted. DNS resolution points to the IP address 91.236.116.20, which belongs to AS42237 (w1n ltd) and is geolocated in Sweden. The page title returned by the last known snapshot reads “kra47 - развитие территорий через AT проекты”, a Russian phrase that does not correspond to a known legitimate service and is typical of placeholder or lure pages used in phishing campaigns.

VirusTotal records show that three out of ninety-five scanning engines flagged the domain, indicating a modest but non-trivial detection rate. The domain also appears on a single public blocklist and is explicitly listed by the PhishDestroy service, reinforcing the classification as a phishing resource. Gridinsoft’s trust scoring system assigns a rating of 0 out of 100, reflecting a complete lack of trust. Taken together, the infrastructure evidence—recent registration, use of a generic Russian-language title, absence of TLS, low-reputation IP hosting, multiple vendor detections, and inclusion on dedicated anti-phishing blocklists—supports the assessment that kra47-at.r-g-k.ru was employed for generic phishing activity before being taken offline.

Because the site is no longer reachable, definitive content analysis is impossible, and the exact phishing lure remains unknown. Defenders should continue to block the domain at network perimeter devices, update proxy and DNS filtering rules, and monitor the associated IP address for any re-use in future campaigns. Additional scrutiny of the hosting provider w1n ltd and the Armadns name servers may reveal related malicious domains.