kra45---c--c[.]ru

Analysis of kra45---c--c.ru shows a confirmed phishing infrastructure that was taken offline prior to the report date of July 23, 2026. The domain was registered on November 18, 2025 through RU-CENTER-RU and resolves to the Cloudflare IP address 172.67.217.167, which is advertised as belonging to AS13335 (Cloudflare, Inc.) and is located in the United States. DNS resolution is served by the Cloudflare authoritative nameservers amos.ns.cloudflare.com and kay.ns.cloudflare.com, and the site was observed using HTTP/3 over a TLS certificate issued by Google Trust Services (WE1). An HTTP request returned a 403 status code, indicating that the server is actively refusing access, which aligns with the current offline status.

Google Safe Browsing has flagged the domain for social engineering, and seven of ninety‑five VirusTotal scanners have marked the host as malicious, reinforcing the suspicion of phishing activity. The page title retrieved from the site reads "kra45 – кофеварка at, kra46 – турка кофейная cc," suggesting a possible lure related to coffee equipment, though the exact content of the page was not captured. The domain appears on a single external blocklist and has been added to the PhishDestroy blocklist, confirming that security vendors have taken mitigation steps.

Defenders should continue to block the domain at network perimeter devices, update any URL filtering feeds with the domain and its associated IP, and monitor for any re‑registration attempts that may reuse the same registrar or hosting provider. Given the Cloudflare front‑end, threat actors could shift the malicious payload to a new hostname on the same IP, so ongoing observation of traffic to 172.67.217.167 is advisable. The limited public intelligence means that additional reconnaissance—such as probing for hidden subdomains or checking for associated email campaigns—may be required to fully map the campaign's scope.