kra43cc-ru[.]ru

This domain, kra43cc-ru.ru, is identified as a generic phishing site targeting users through a fraudulent online storefront for tabletop games. Analysis of the page title, "Kra43 — магазин авторских настольных игр CC версия," indicates an attempt to impersonate a legitimate retailer of custom or collector’s edition board games. No specific drainer kit or cryptocurrency theft mechanism has been confirmed, but the domain exhibits characteristics consistent with credential harvesting or fraudulent transaction schemes. The use of localized language (Russian) suggests targeting of regional users, though the infrastructure may support broader campaigns. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 8 out of 95 security vendors on VirusTotal, with detections spanning phishing and malicious site classifications. It was registered through REGRU-RU on November 10, 2025, and resolves to the IP address 91.236.116.129. The domain appears on at least one security blocklist, though it is not currently listed in Google Safe Browsing (GSB) as of the latest verification. The creation date and registrar choice align with patterns observed in short-lived phishing operations, where domains are rapidly deployed and discarded. As of the most recent assessment, kra43cc-ru.ru has been taken offline, likely due to hosting provider or registrar intervention. However, the residual risk remains elevated for users who may have interacted with the site prior to its deactivation. Historical DNS records and cached content may still pose a threat if accessed through archival services or local browser caches. Organizations and individuals are advised to monitor for unauthorized transactions, credential reuse, or secondary infections linked to this domain. Blocking the IP 91.236.116.129 and implementing sinkholing for the domain can mitigate further exposure.