kra-----43c-c[.]ru

The domain kra-----43c-c.ru has been identified as a credential phishing infrastructure targeting users through fraudulent branding. Analysis indicates this domain was operational under the guise of a creative agency, specifically impersonating a legitimate branding service to harvest login credentials or financial information. The domain is currently offline, but prior activity warrants further scrutiny due to its elevated risk classification. Infrastructure analysis reveals the domain was registered through UK-WIN (ASN: 42237) and resolved to the IP address 193.105.134.21. Security vendor assessments on VirusTotal show 4 of 95 engines flagged this domain as malicious, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist, specifically PhishDestroy, and presented a page title in Russian: "Креативное агентство Kra43 CC — бренд, который говорит сам за себя." No historical WHOIS data is available to determine the exact creation date, but the combination of low detection rates and targeted impersonation suggests a short-lived, evasive campaign. Current status indicates the domain has been taken offline, reducing immediate risk to end users. However, organizations should proactively block the domain and associated IP (193.105.134.21) at the network perimeter to prevent potential re-emergence. Security teams are advised to monitor for similar impersonation attempts using the same registrar (UK-WIN) or IP range. Endpoint protection systems should be updated to include this domain in phishing detection rules, and users should be educated on recognizing credential harvesting attempts, particularly those leveraging fake branding or agency-themed lures. Post-incident review of logs for connections to 193.105.134.21 is recommended to identify any prior exposure.