kra46-at[.]ledi-cb[.]ru

The domain kra46-at.ledi-cb.ru was registered on 11 December 2024 through the REGRU-RU registrar and currently resolves to the IP address 193.105.134.30, which belongs to AS42237 w1n ltd in Sweden. The authoritative name servers are ns1.armadns.icu and ns2.armadns.icu. No TLS certificate is presented for the host, indicating that connections are served over plain HTTP only. Threat intelligence indicates that the site was classified as generic phishing and that twelve of ninety‑five VirusTotal scanners flagged the domain as malicious.

It appears on a single external blocklist and has been explicitly blocked by the PhishDestroy mitigation service. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment. The page title returned from the site, "kra46 - AT платформа для стильных образов," is presented in Cyrillic script and suggests a Russian‑language service, potentially targeting Russian‑speaking users with a style‑oriented theme. The domain is presently taken offline, but its recent creation date and the observed infrastructure indicate that the operator may reactivate the domain or reuse the underlying IP address for future campaigns.

Defenders should add kra46-at.ledi-cb.ru and its IP 193.105.134.30 to network deny lists, monitor DNS query logs for any attempts to resolve the domain, and watch for related activity from the armadns.icu name‑server pair. Continuous re‑scanning of the IP block is advised, as malicious actors often pivot to adjacent hosts. Given the lack of SSL and the low trust score, any inbound traffic to this host should be blocked until further verification confirms that the site is no longer being used for phishing.