kra47-at[.]hsh72[.]ru

This domain is flagged as an elevated-risk phishing site targeting users seeking adventure tourism services, specifically impersonating an organizer of Robinson Crusoe-style expeditions. The threat type is credential harvesting and financial fraud, leveraging fake booking or registration pages to collect personal and payment data from victims under the guise of legitimate outdoor activity planning. Analysis indicates the domain kra47-at.hsh72.ru was registered on February 08, 2025, through REGRU-RU, a registrar frequently associated with malicious infrastructure. It resolves to IP address 193.105.134.30, hosted on AS42237 (w1n ltd) in Sweden, a network segment with a history of abuse. The domain lacks an SSL certificate, increasing exposure to man-in-the-middle interception. VirusTotal detection shows 11 out of 95 security vendors have flagged the domain as malicious, while it appears on one additional security blocklist. The page title, "krab1 - организатор AT приключений в стиле робинзонады," suggests a localized campaign targeting Russian-speaking users. Mitigation requires immediate blocking of the domain and its resolving IP (193.105.134.30) at the network perimeter. Security teams should update endpoint protection rules to detect and prevent access to kra47-at.hsh72.ru and monitor for related domains using similar naming patterns (e.g., "kraXX-at"). Users who may have interacted with the site should be instructed to reset credentials on any accounts used during the session, particularly if payment details were entered. Network logs should be reviewed for connections to 193.105.134.30 or domains registered via REGRU-RU within the same timeframe to identify potential compromise.