kra46at[.]pvvpermanentatoo[.]ru

The domain kra46at.pvvpermanentatoo.ru was registered on 11 December 2024 through the REGRU‑RU registrar. DNS resolution points to the IP address 193.105.134.30, which belongs to AS42237 operated by w1n ltd and is geolocated in Sweden. Both authoritative name servers are hosted on the armadns.icu infrastructure (ns1.armadns.icu, ns2.armadns.icu). No TLS certificate is presented for the host, indicating that connections are made over plain HTTP only.

The site’s sole visible page title reads “kra46 – студия AT перманентного макияжа с инновационным подходом”, suggesting the domain is being used to impersonate a Russian permanent‑makeup studio, a typical lure for credential‑stealing campaigns. Detection telemetry shows that eleven of ninety‑five VirusTotal scanners flagged the domain, and it appears on one external blocklist. The Gridinsoft trust score is zero out of one hundred, reinforcing the malicious assessment. PhishDestroy has already added the domain to its blocklist, and the current operational status is reported as offline.

The elevated risk rating aligns with the generic phishing classification, but concrete evidence of the phishing payload or targeted credentials has not been captured. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence of the host, and consider adding the associated IP range to deny lists. Ongoing observation of the registrar and name‑server changes is advised, as threat actors often relocate infrastructure while preserving the same domain registration details.