kra46-cc[.]swedservice[.]ru

Analysis on July 22 2026 indicates that the domain kra46-cc.swedservice.ru, created on 11 December 2024 via the REGRU‑RU registrar, resolved to the IPv4 address 193.105.134.30. The IP is advertised as belonging to AS42237 w1n ltd and is geolocated to Sweden. No TLS certificate was presented during connection attempts, confirming that the service operated over plain HTTP only. The authoritative name servers are ns1.armadns.icu and ns2.armadns.icu, both hosted on the armadns.icu zone. The page title returned by the now‑offline site was “kra46 - воплощает муниципалитет СС уровня”, which provides no additional context about the intended victim or lure.

Gridinsoft assigned a trust score of 0 / 100, and the domain appears on a single security blocklist. VirusTotal recorded a single positive detection out of 95 scanned scanners, and the domain has been explicitly blocked by the PhishDestroy mitigation service. The current HTTP status is offline, indicating that the phishing infrastructure has been taken down or is otherwise unavailable. Evidence confirms the existence of a generic phishing infrastructure tied to this domain, but the specific phishing kit, targeted brand, or victim demographics remain unknown.

The lack of SSL, low trust score, and minimal blocklist presence suggest a short‑lived operation that relied on rapid deployment rather than sophisticated hosting. Defenders should continue to monitor the associated IP address for any re‑use, enforce outbound filtering for the domain and its name servers, and consider adding the IP and domain to internal blocklists if not already present. Given the single vendor detection, additional sandboxing of any URLs observed in email or web traffic that reference this domain is advisable. Ongoing intelligence collection should focus on any resurgence of the domain, changes in DNS records, or new detections from threat‑intel feeds.