kra42-at-web[.]ru

Analysis of kra42-at-web.ru indicates a generic phishing domain targeting Russian-speaking users under the pretext of selling windows and sills. The domain was registered on November 19, 2025, through REGRU-RU, a registrar frequently associated with low-reputation infrastructure. It resolves to 193.105.134.21, an IP address hosted by AS42237 (w1n ltd) in Sweden, a network segment previously linked to phishing and fraudulent activity. No SSL certificate was detected, increasing the risk of credential interception or malware delivery via unencrypted connections. The page title, 'Kra42 — уютные окна, свет и красивые подоконники AT версия,' suggests a localized scam posing as a home improvement service.

As of July 25, 2026, the domain is offline, though its prior operational status remains unconfirmed through direct observation. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as malicious. Fourteen of ninety-five security vendors on VirusTotal flagged the domain at the time of assessment, while PhishDestroy and one additional blocklist have listed it. Nameservers (ns1.reg.ru, ns2.reg.ru) align with the registrar, offering no diversification in hosting providers. Defenders should treat this domain as a confirmed phishing threat, particularly in environments serving Russian-speaking users or sectors related to construction and retail.

Block the domain and its resolving IP at perimeter controls, and monitor for reuse of the infrastructure under new domains. Given the absence of SSL and the registrar's history, assume any prior activity involved credential harvesting or fraudulent transactions. No brand-specific indicators (e.g., logos, payment portals) were analyzed, so the exact monetization method remains unconfirmed. Infrastructure reuse patterns suggest potential for future campaigns; defenders should correlate this IP and registrar with other low-reputation domains.