kra47at[.]rusexshop-intim[.]ru

The domain kra47at.rusexshop-intim.ru presents an elevated risk due to its classification as a generic phishing threat. It impersonates a transportation platform called kra47, specifically targeting users in Siberia with a fake taxi ordering service. The site's title, kra47 - транспортная платформа CC для заказа такси в Сибири, suggests it aims to deceive victims into providing sensitive information under the guise of a legitimate ride-hailing application.

Analysis of available intelligence reveals several concerning indicators. The domain resolves to IP address 193.105.134.30 and was created on February 07, 2025, through the registrar REGRU-RU. VirusTotal data shows 2 out of 95 security vendors flagging this domain as malicious. The Gridinsoft trust score is 0/100, indicating no confidence in its legitimacy. The domain appears on 1 security blocklist and has been taken offline, currently showing an offline status. It was blocked by PhishDestroy, confirming its malicious nature.

Mitigation steps for this generic phishing threat include ensuring all users who may have visited the domain are alerted and instructed to change any credentials entered on the site. Network administrators should block the IP 193.105.134.30 and the domain at the firewall or proxy level to prevent future access. Since the domain is offline, continued monitoring for similar domains registered through REGRU-RU under the same pattern is recommended. Users should be educated about phishing tactics that impersonate local services, such as taxi platforms, to reduce the risk of future compromises.