kra47cc[.]faberlikdom[.]ru

This domain, kra47cc.faberlikdom.ru, is flagged as a high-risk credit card phishing threat targeting users through a fraudulent product catalog interface. The page title, 'kra47 - домашний CC каталог товаров для красоты,' explicitly references credit card (CC) data collection, aligning with credential harvesting tactics commonly employed in phishing campaigns. Analysis indicates the domain is actively soliciting sensitive financial information under the guise of a legitimate beauty product catalog, a hallmark of phishing operations designed to exploit trust in established brands.

Infrastructure analysis reveals multiple technical indicators corroborating the malicious classification. The domain was registered on January 7, 2025, through REGRU-RU, a registrar frequently associated with abusive domains. It resolves to the IP address 193.105.134.30, hosted on AS42237 (w1n ltd) in Sweden, an autonomous system with a history of hosting phishing infrastructure. No SSL certificate is present, leaving data transmissions unencrypted and vulnerable to interception. Detection metrics further substantiate the threat: VirusTotal reports 10 out of 95 security vendors flagging the domain, while Google Safe Browsing and PhishDestroy have both blocked it. The domain also appears on one additional security blocklist, reinforcing its classification as a confirmed phishing resource.

Mitigation measures should prioritize immediate isolation and verification protocols. Users encountering this domain are advised to terminate all interactions and avoid inputting any personal or financial data. Network administrators should implement DNS-based blocking for 193.105.134.30 and kra47cc.faberlikdom.ru, while monitoring for lateral movement or credential reuse attempts. Financial institutions should be notified if credit card details were submitted, as compromised data may be leveraged for unauthorized transactions. Given the domain's recent registration and active status, continuous monitoring for related infrastructure (e.g., subdomains, newly registered lookalike domains) is recommended to preempt further exploitation.