www1[.]kra------40--cc[.]ru

This domain, www1.kra------40--cc.ru, is identified as a credential harvesting phishing site targeting users through deceptive advertising service lures. The page title, 'kra44 - эталон профессионализма AT в рекламном проектировании,' suggests an attempt to impersonate a legitimate advertising or marketing platform, likely to trick victims into submitting sensitive credentials such as usernames, passwords, or financial details. The domain employs social engineering tactics, presenting itself as a professional entity to lower user defenses and increase the likelihood of successful exploitation. Analysis of the domain reveals multiple technical indicators confirming its malicious nature. The domain is flagged by 2 out of 95 security vendors on VirusTotal, indicating detection by at least two independent threat intelligence sources. It appears on one security blocklist, further corroborating its classification as a phishing threat. Infrastructure analysis reveals the domain resolves to the IP address 193.105.134.30 and is registered through UK-WIN (ASN: 42237). The Gridinsoft trust score for this domain is 0/100, reflecting a complete lack of legitimacy. The domain is currently offline, but its prior activity and registration details remain a concern for retrospective threat assessment. Users who accessed or interacted with www1.kra------40--cc.ru should take immediate remedial actions to mitigate potential risks. If credentials were entered on the site, affected accounts must be secured by changing passwords and enabling multi-factor authentication where available. System scans using updated security tools are recommended to detect any secondary payloads or malware that may have been delivered. Network logs should be reviewed for connections to 193.105.134.30 or related domains registered under UK-WIN (ASN: 42237). Organizations should update their blocklists to include this domain and its associated IP to prevent future access attempts. Monitoring for unusual account activity or unauthorized access attempts is critical in the days following exposure.