krak45-at[.]ru

This domain, krak45-at.ru, is identified as a credential harvesting phishing site targeting users through deceptive retail-themed content. The page title, 'Kra45 — вечерний свет, домашняя атмосфера и теплые оттенки AT версия,' suggests an attempt to impersonate a legitimate e-commerce or lifestyle brand, likely leveraging social engineering tactics to trick victims into entering sensitive login or payment details. No specific drainer kit signatures have been confirmed, but the generic phishing infrastructure aligns with common credential theft campaigns observed in the wild. Analysis indicates the domain was registered on November 22, 2025, through REGRU-RU, a registrar frequently associated with malicious activity. It resolves to the IP address 193.105.134.21, hosted under AS42237 (w1n ltd) in Sweden, a network segment previously linked to phishing and fraud operations. The domain lacks an SSL certificate, increasing the likelihood of interception or tampering during data transmission. Detection metrics reveal 17 out of 95 security vendors on VirusTotal flagged krak45-at.ru as malicious, while Google Safe Browsing explicitly labels it as a phishing threat. Additionally, the domain appears on one security blocklist, further corroborating its malicious classification. As of the latest assessment, krak45-at.ru has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a latent threat, as domains registered through this pattern often resurface under similar names or reappear after brief dormancy. Organizations and users are advised to block the domain and its associated IP (193.105.134.21) at the network level, monitor for related typosquatting variants, and educate users on recognizing retail-themed phishing lures. Continuous vigilance is recommended, as threat actors may re-deploy the same infrastructure with minimal modifications.