kra46cc[.]amc-nsk[.]ru

The domain kra46cc.amc-nsk.ru was registered on December 11, 2024 through the REGRU-RU registrar and currently resolves to IP address 193.105.134.30, which belongs to AS42237 (w1n ltd) and is geolocated in Sweden. The site presents the page title "kra46 - центр CC разработки для новосибирских технологий," suggesting an impersonation of a Russian technology development center, although the exact target audience or brand is not explicitly confirmed. No SSL certificate is observed, meaning the site operates over plain HTTP, which reduces transport‑level security and may facilitate credential harvesting. VirusTotal records show that 10 of 95 scanned security vendors flagged the domain, indicating a moderate consensus of malicious activity among scanning engines.

Google Safe Browsing classifies the site as a social‑engineering threat, and PhishDestroy has already added the domain to its blocklist. Additionally, Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one external security blocklist, reinforcing the suspicion of malicious intent. The domain is currently offline, and the hosting infrastructure uses the armadns.icu nameservers (ns1.armadns.icu and ns2.armadns.icu).

While the exact phishing kit or credential‑capture mechanism remains unknown due to a lack of page‑level analysis, the combination of vendor detections, safe‑browsing flag, low trust score, and the deceptive Russian‑language title indicates a high‑risk generic phishing operation. Defenders should continue to block traffic to 193.105.134.30, monitor DNS queries for the associated nameservers, and update intrusion‑prevention signatures to include the domain and its IP. Organizations with Russian‑focused user bases should educate users about the lack of SSL and the suspicious page title that mimics a legitimate development center, and consider employing URL filtering that references the current blocklist entries.