1-kra46-at[.]ru

Analysis of the domain 1-kra46-at.ru, created on December 01, 2025, shows a clear infrastructure footprint consistent with a phishing operation. The domain is delegated to the Russian registrar REGRU-RU and uses the registrar’s default nameservers ns1.reg.ru and ns2.reg.ru. DNS resolution points to the address 198.18.1.205, an IP that currently hosts the site but lacks an SSL certificate, indicating that any traffic would be unencrypted and vulnerable to interception.

The domain has been listed on a single security blocklist and is actively blocked by the PhishDestroy service, reinforcing its classification as a malicious resource. VirusTotal analysis reports that seven out of ninety‑five scanning engines flag the domain as malicious, providing independent vendor corroboration of the threat. The site’s operational status is recorded as offline at the time of assessment, and no HTTP response codes, page titles, or Safe Browsing entries are available for further content verification.

Because the public page has not been captured, the exact phishing lure or targeted brand cannot be determined, leaving the content layer of the threat unknown. Defenders should continue to enforce DNS‑level blocking for 1-kra46-at.ru, incorporate the IP address 198.18.1.205 into network‑level deny lists, and monitor for any re‑appearance of the domain in future DNS queries. Ongoing observation of threat‑intel feeds for additional indicators—such as new blocklist entries, SSL deployment attempts, or changes in vendor detection scores—is recommended to maintain situational awareness and to mitigate potential re‑use of the infrastructure in future campaigns.