kra46[.]bere3ka[.]ru

Analysis of kra46.bere3ka.ru shows that the domain was registered on 10 December 2024 through the REGRU-RU registrar. The site is currently offline, and the hosting infrastructure points to the IPv4 address 193.105.134.30, which is announced by ASN AS42237 belonging to w1n ltd and geolocated to the southeastern region. The domain resolves to two authoritative name servers, ns1.armadns.icu and ns2.armadns.icu, which are commonly observed in malicious campaigns. Google Safe Browsing has flagged the URL for social engineering, indicating that it is likely used to lure victims into providing credentials or personal data.

The page title retrieved before takedown reads “kra46 - уютный AT уголок handmade изделий”, a Russian phrase that suggests a handcrafted goods theme, but no further content analysis is available. PhishDestroy has placed the domain on its blocklist, and the domain appears on at least one additional security blocklist. VirusTotal reports that 12 out of 95 scanned scanners flagged the domain, reinforcing the suspicion of malicious intent. The site lacks an SSL/TLS certificate, meaning all HTTP traffic would be unencrypted and vulnerable to interception.

Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of trustworthiness. Because the domain is already taken offline, immediate mitigation focuses on ensuring that any cached references are removed from internal URL filters and that endpoint protection solutions are updated with the observed indicators, including the domain name, its IP address, and the associated name servers. Defenders should continue to monitor for re‑registration or similar patterns using the same registrar or hosting ASN. At this stage, the exact phishing payload or target brand remains unknown, so investigators should treat any future activity involving this infrastructure as high‑risk until further forensic evidence is obtained.