kra46-cc[.]vvisk[.]ru

On 25 July 2026, the domain kra46-cc.vvisk.ru was observed offline but retains several indicators of malicious activity. The domain was registered through the Russian registrar REGRU-RU on 06 December 2024 and resolves to the IP address 193.105.134.30, which belongs to ASN 42237 (w1n ltd) and is geolocated in Sweden. DNS resolution is delegated to the authoritative name servers ns1.regerey.com and ns2.regerey.com. No TLS certificate is presented, meaning any HTTP traffic would be unencrypted. The only visible page title retrieved before takedown is “kra46 - воплощает муниципалитет СС уровня”, suggesting an attempt to impersonate a municipal authority, consistent with the generic phishing classification. VirusTotal scans flagged the domain in 10 of 95 security engines, indicating consensus among multiple vendors that the host is malicious. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one external blocklist. The active blocklist entry is recorded by the PhishDestroy service, which has already taken the site offline.

Analysis of the available artifacts confirms that the infrastructure is typical of phishing operations: a recently created domain, use of a low‑reputation registrar, and hosting on an IP address shared with other malicious payloads in the same ASN. However, the limited public data leaves several gaps. The exact phishing kit, targeted victims, and any command‑and‑control communication have not been disclosed. No SSL/TLS certificate, safe‑browsing verdict, or Open Threat Exchange identifiers are available, preventing deeper correlation with known campaigns. The page content beyond the title has not been captured, so the specific credential‑stealing vector cannot be described.

Defenders should block both the fully qualified domain name and its resolved IP address at perimeter firewalls and DNS filtering solutions. The associated name servers and the ASN should be added to threat‑intel watchlists to monitor for future reuse.