kra46cc[.]rembyt76[.]ru

Analysis of kra46cc.rembyt76.ru shows a confirmed generic phishing infrastructure that was taken offline prior to the assessment date of July 24, 2026. The site presented the page title "kra46 - автоматизированная CC система управления ЖКХ," indicating a likely attempt to impersonate a Russian municipal services portal. VirusTotal records show five of ninety‑five scanning engines flagging the domain, providing independent confirmation of malicious intent. The domain resolves to IP address 193.105.134.30, which is registered to AS42237 operated by w1n ltd in Sweden, suggesting the hosting is provided by a foreign carrier rather than a local Russian provider.

Nameservers ns1.armadns.icu and ns2.armadns.icu are listed, both belonging to the armadns.icu service, a common choice for disposable or rapidly re‑hosted malicious sites. Registration was performed through REGRU-RU, and the domain was created on December 10, 2024, giving it a relatively short lifespan before detection. Gridinsoft assigned a trust score of 0 out of 100, and no SSL certificate was observed, indicating an unencrypted HTTP service that likely hosted credential‑stealing forms. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy, reinforcing the consensus that it is a phishing vector.

Current HTTP status is offline, so direct content verification is not possible; therefore, the exact payload and page behavior remain uncertain. Defenders should immediately add the domain and its resolving IP to network deny lists, monitor for any re‑use of the IP range, and enforce strict TLS inspection to detect any future unencrypted phishing attempts from similar hosting providers. Continuous watch on armadns.icu name servers and REGRU‑RU registrations is advised, as they have historically facilitated rapid deployment of malicious domains.