kra47at[.]kvartira2u[.]ru

This domain, kra47at.kvartira2u.ru, is flagged as a generic credit card phishing site designed to harvest financial credentials under the guise of a literary rare book store. The page title, 'kra47 - литературный CC магазин редких изданий,' explicitly references credit card (CC) sales, indicating a fraudulent operation targeting payment data. No legitimate brand association is identified, and the infrastructure does not align with known drainer kits, suggesting a custom or low-sophistication phishing framework. Infrastructure analysis reveals the domain was registered on January 13, 2025, through REGRU-RU, a registrar frequently associated with malicious activity. It resolves to the IP address 91.236.116.20, a host with a history of supporting phishing and malware distribution. Detection metrics show 5 out of 95 security vendors on VirusTotal flag the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist, and no Google Safe Browsing (GSB) detections are recorded at the time of analysis. The domain is currently offline, likely due to takedown efforts or infrastructure rotation. However, residual risk remains elevated due to the registrar's reputation and the IP's association with prior malicious campaigns. Users who interacted with the site are advised to monitor financial statements for unauthorized transactions and rotate any exposed credentials. Organizations should update blocklists to include the domain and IP, while security teams should investigate potential lateral movement from compromised endpoints.