kra38-----cc[.]ru

This domain, kra38-----cc.ru, was registered on 2025-09-02 through the REGRU‑RU registrar. The site resolves to the IPv4 address 193.105.134.30, which belongs to AS42237 operated by w1n ltd and is geolocated to Sweden. Nameserver records point to ns1.regerey.com and ns2.regerey.com. No TLS certificate is presented, indicating the site serves only HTTP.

The page title returned by the HTTP response is the literal string “kra38-----cc.ru”, providing no additional context about the hosted content. Gridinsoft assigns a trust score of 0 out of 100, reflecting a highly malicious assessment. VirusTotal reports that 11 of 95 scanning engines flagged the domain, and Google Safe Browsing classifies it as a social‑engineering threat. The domain appears on a single security blocklist and has been taken offline, with the takedown attributed to the PhishDestroy mitigation service.

The current status is offline, but the underlying infrastructure – registrar, hosting ASN, and IP address – remains observable and could be reused for future campaigns. Uncertainty remains regarding the exact phishing payload, targeted brands, or compromised credentials, as no further page content has been disclosed. Defenders should continue to block the domain and its associated IP, monitor the ASN for new registrations, and ensure that outbound filtering rules reference the observed nameservers and registrar information. Ongoing threat‑intel feeds should be consulted for any re‑appearance of the same infrastructure.