kra-----36-cc[.]ru

Analysis of the domain kra-----36-cc.ru as of 24 July 2026 indicates that the site is currently offline. The domain was registered on 27 July 2025 through the Russian registrar REGRU-RU and uses the nameservers ns1.regerey.com and ns2.regerey.com. DNS resolution points to the IP address 198.18.1.49, which is not associated with a valid SSL certificate, confirming that HTTPS is unavailable. The page title returned by the server matches the domain name itself, providing no additional context about the hosted content.

VirusTotal scans have recorded 14 detections out of 95 security vendors, suggesting that a notable portion of the scanning community identifies the domain as malicious. Independent security services have also flagged the domain: PhishDestroy lists it as blocked, Gridinsoft assigns a trust score of 0 out of 100, and it appears on at least one public blocklist. AlienVault OTX references the domain in a single threat‑intelligence pulse, reinforcing its association with malicious activity. The available evidence collectively points to a generic phishing operation, although the specific target or lure employed by the site cannot be confirmed from the present data.

The lack of an SSL certificate and the offline status limit immediate interaction, but the historical presence on multiple blocklists and the vendor detections indicate that the domain should be treated as hostile. Defenders should ensure that any outbound connections to 198.18.1.49 are denied, update DNS filtering policies to block kra-----36-cc.ru, and propagate the indicator to endpoint protection and web‑gateway solutions. Continuous monitoring of the registrar REGRU-RU for new domains that resolve to the same IP address or share the same nameservers is advisable, as adversaries often reuse infrastructure.