kra46-cc[.]mhch-bankrot-netdolgov[.]ru

The domain kra46-cc.mhch-bankrot-netdolgov.ru was registered through REGRU-RU on December 11, 2024. It resolves to the IPv4 address 193.105.134.30, which is announced by AS42237 w1n ltd and geolocated in Sweden. Authoritative name servers are ns1.armadns.icu and ns2.armadns.icu, both of which remain active despite the site being taken offline.

No TLS certificate was observed, meaning the service was delivered over plain HTTP when it was reachable. The page title captured during the brief exposure was “kra46 - надёжная CC поддержка в вопросах банкротства”, a Russian phrase that translates to “kra46 – reliable CC support for bankruptcy matters”, matching the declared banking phishing motive. VirusTotal records indicate that 11 of 95 scanned security engines flagged the domain as malicious, and the domain appears on one external security blocklist.

PhishDestroy has confirmed that the site is currently offline, and the Gridinsoft trust score of 0 out of 100 further underscores its malicious reputation. The elevated risk rating is consistent with the combination of a low‑reputation host, lack of encryption, and multiple security vendor detections. Defensive recommendations include enforcing DNS‑based and proxy‑level blocking of the domain and its associated IP address, monitoring the listed name servers for future activity, and adding the observed page title and registration details to internal threat‑intel repositories to improve detection of re‑used infrastructure in subsequent campaigns.