kra46at[.]climatcontroll[.]ru

On July 24, 2026 the domain kra46at.climatcontroll.ru was observed offline but remains listed as a generic phishing indicator. The domain was registered on December 10, 2024 through the Russian registrar REGRU-RU. It is delegated to the authoritative nameservers ns1.armadns.icu and ns2.armadns.icu, which resolve the host to the IPv4 address 193.105.134.30. The IP resides in Sweden (country code SE) and is announced by AS42237 belonging to w1n ltd. No TLS certificate is presented; the site is reachable only via HTTP, and the lack of encryption further reduces confidence in its legitimacy.

The page title returned from the host, “kra46 - инновационная AT система управления климатом”, suggests an attempt to masquerade as a climate‑control management interface, although no additional branding is disclosed. Threat intelligence shows the domain appears on a single security blocklist and is explicitly blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious intent. VirusTotal analysis recorded four detections out of ninety‑five scanners, confirming that a minority of AV engines flag the domain as malicious. The limited detection count and single blocklist entry imply that the infrastructure is either newly deployed or has been partially mitigated.

Uncertainties remain regarding the specific payload or credential‑harvesting mechanisms employed, as the site content beyond the title has not been captured. No evidence of additional hosting services, compromised accounts, or associated command‑and‑control infrastructure is available. Defenders should continue to block the domain and its resolved IP at network perimeters, add the host to internal phishing blocklists, and monitor for any resurgence of activity. Continuous re‑scanning of the domain and its IP through multi‑engine services is recommended to capture potential changes in detection status.