kra46-at[.]samaraharry[.]ru

The domain kra46-at.samaraharry.ru was observed hosting a page titled “AT‑программа kra46 для активных людей”. The site was registered on 10 December 2024 through the Russian registrar REGRU‑RU and is currently taken offline. DNS resolution points to 193.105.134.30, an address announced by AS42237 (w1n ltd) located in Sweden. Both authoritative name servers are ns1.armadns.icu and ns2.armadns.icu, indicating use of the Armadns hosting service. No TLS certificate is presented, so the site only served HTTP traffic. Threat‑intelligence feeds have flagged the domain as a phishing vector: Google Safe Browsing lists it under social‑engineering, PhishDestroy has added it to its blocklist, and it appears on one additional security blocklist.

Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme risk. VirusTotal analysis shows that 10 of 95 scanned security engines flagged the domain as malicious, corroborating the phishing classification. The combination of a newly created Russian‑registered domain, lack of encryption, low trust score, and multiple independent detections suggests an active campaign aimed at luring victims to a fraudulent “AT‑program” service. Uncertainty remains regarding the exact payload or credential‑stealing mechanism, as the page content has not been publicly released and no malware hashes have been linked to the host. Additionally, the limited number of blocklist listings (one external list) may indicate that the domain’s exposure was short‑lived before takedown.

Defenders should block DNS resolution to 193.105.134.30 and add kra46-at.samaraharry.ru to local URL filtering rules. Monitoring of outbound traffic to the associated IP range and the AS42237 prefix is recommended. Because the site lacks SSL, any attempted HTTPS connections will fail, but HTTP requests may still be logged. Continuous re‑scanning of the domain on multi‑engine platforms such as VirusTotal is advised to capture any future changes.