kra46-at[.]moskva-domashniy-internet[.]ru

Analysis of kra46-at.moskva-domashniy-internet.ru indicates a high-risk phishing domain targeting Russian-speaking users under the guise of home internet services in Moscow. The domain was registered on December 11, 2024, through REGRU-RU, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the use of nameservers ns1.armadns.icu and ns2.armadns.icu, a pattern observed in other fraudulent domains leveraging the armadns.icu DNS provider. The domain resolves to IP address 193.105.134.30, hosted on AS42237 (w1n ltd) in Sweden, a network with a history of hosting malicious activity.

The page title, 'kra46 - AT подключение домашнего интернета в Москве,' suggests an attempt to impersonate a legitimate internet service provider (ISP) in Moscow, though no specific brand is confirmed from the available evidence. Google Safe Browsing has flagged the domain for social engineering, and it appears on at least one security blocklist. Thirteen of 95 security vendors on VirusTotal have detected the domain as malicious, though the absence of an SSL certificate and the domain's current offline status limit further analysis. Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk classification.

Defenders should treat this domain as part of a broader phishing campaign targeting Russian internet users. The combination of a recently registered domain, suspicious DNS infrastructure, and confirmed detections by multiple security vendors warrants immediate blocking. While the exact content of the phishing page remains unanalyzed, the observable indicators—including the page title, registrar, hosting provider, and detection data—align with known phishing tactics. Organizations should monitor for related domains using the same nameservers or hosting infrastructure and update blocklists accordingly.