kra45-at[.]kra-------40--cc[.]ru

This domain, kra45-at.kra-------40--cc.ru, is flagged as an elevated-risk credential theft operation targeting business users. Analysis indicates the site impersonates a corporate platform under the guise of a "CC платформа AT бизнес-решений" service, likely designed to harvest login credentials or financial data from unsuspecting employees or clients. The specific threat type—credential theft—is confirmed by the page title and the domain’s infrastructure, which lacks legitimate business associations. Infrastructure analysis reveals the domain resolves to the IP address 193.105.134.30, hosted by UK-WIN (ASN: 42237) with an IP geolocation in Sweden (AS42237, w1n ltd). The domain is registered through the same provider and currently appears offline, though it remains detectable by security systems. VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious, while a single blocklist (PhishDestroy) has already classified it as a threat. No SSL certificate is present, further reducing trust indicators for end users. The low detection count relative to vendor coverage suggests the campaign may still be in an early or targeted phase. Mitigation against credential theft from such domains requires immediate action. Users who may have interacted with kra45-at.kra-------40--cc.ru should invalidate any exposed credentials, particularly for corporate or financial accounts, and enable multi-factor authentication where available. Organizations should block the domain and its resolving IP (193.105.134.30) at the network level, while security teams should monitor for related indicators of compromise, such as the registrar ASN (42237) or the hosting provider’s infrastructure. Employee training should emphasize verifying domain authenticity before entering sensitive information, especially for platforms claiming to offer business solutions.