kra46[.]dantist18[.]ru

Analysis of the domain kra46.dantist18.ru shows a high‑risk generic phishing infrastructure that has been taken offline as of the report date, July 24 2026. The domain was registered on 11 December 2024 through the Russian registrar REGRU‑RU and is delegated to the authoritative name servers ns1.armadns.com and ns2.armadns.com. DNS resolution maps the name to the IPv4 address 193.105.134.30, which belongs to AS42237 (w1n ltd) and is geolocated in Sweden. No TLS certificate is presented, indicating that the site was served only over HTTP. The page title retrieved from the host reads “kra46 - стоматология нового поколения с CC стандартами качества,” suggesting an attempt to masquerade as a modern dental service, but the content of the page has not been captured for further analysis.

Reputation signals are strongly negative: the domain appears on one security blocklist and has a Gridinsoft trust score of 0 / 100. VirusTotal scans returned ten detections out of ninety‑five anti‑malware engines, confirming that multiple vendors consider the host malicious. Google Safe Browsing flags the site for social engineering, and PhishDestroy has listed it as a blocked phishing resource. The current operational status is “offline,” and the site is no longer reachable. Given the available indicators, defenders should immediately block both the FQDN and its resolved IP address at network perimeters and DNS filtering solutions.

Continuous monitoring of the AS42237 range is advised, as the infrastructure could be reused for related campaigns. Because the site lacked HTTPS, any potential credential capture would have occurred over clear‑text channels, increasing the risk of data exposure. Analysts should treat any traffic to this domain observed prior to its takedown as compromised and should investigate user logs for possible credential harvesting.