kra46cc[.]sale-gooods[.]ru

Analysis of the domain kra46cc.sale-gooods.ru confirms its classification as a credit card phishing site, operational since December 6, 2024, and taken offline by July 22, 2026. The domain was registered through REGRU-RU, a registrar frequently associated with abusive domains, and resolved to the IP address 193.105.134.30, hosted under AS42237 (w1n ltd) in Sweden. Infrastructure analysis reveals the use of nameservers ns1.regerey.com and ns2.regerey.com, a pattern observed in other low-reputation domains. The page title, 'kra46 - выгодные предложения товаров по CC стандартам,' explicitly references credit card standards, indicating a likely focus on harvesting payment card details from Russian-speaking users. Detection data is limited but consistent with phishing activity.

As of the last scan, two of 95 security vendors on VirusTotal flagged the domain, while PhishDestroy and one additional security blocklist marked it as malicious. Gridinsoft assigned a trust score of 0/100, further supporting its classification as high-risk. The absence of an SSL certificate is notable, as legitimate e-commerce sites typically enforce HTTPS to secure user data. The domain's short lifespan—approximately seven months—aligns with patterns observed in phishing campaigns, where domains are frequently discarded to evade detection. Defenders should treat this domain as confirmed malicious infrastructure.

Network-level blocking of 193.105.134.30 and associated nameservers is recommended to prevent further exposure. Given the domain's offline status, no active threat remains, but historical logs should be reviewed for connections to this IP or domain. Additional scrutiny of domains registered through REGRU-RU with similar naming conventions (e.g., sale-gooods.ru) may identify related campaigns. No evidence links this domain to a specific phishing kit or brand impersonation beyond the credit card theme suggested by the page title.