kra47-cc[.]razvodimsia[.]ru

Analysis of kra47-cc.razvodimsia.ru indicates that the domain was registered on 2025-03-02 through the REGRU-RU registrar and is currently hosted on IP 193.105.134.30, which belongs to AS42237 operated by w1n ltd in Sweden. The site resolves to the same address and presents no TLS certificate, implying all traffic is unencrypted HTTP. The page title observed during the brief crawl was “krab1 - автоматизированная CC‑система прачечных услуг”, which suggests a Russian‑language service offering but does not provide further functional detail. Google Safe Browsing classifies the URL as a social engineering threat, and the domain appears on a single security blocklist.

Independent security vendors have flagged the domain in 13 of 95 scans on VirusTotal, reinforcing the malicious classification. Gridinsoft assigns a trust score of 0 out of 100, and the domain is actively blocked by PhishDestroy. The infrastructure uses the nameservers ns1.regerey.com and ns2.regerey.com, both of which are typical for domains registered through REGRU-RU.

The site’s current status is offline, limiting immediate observation, but the historical evidence points to a high‑risk phishing operation targeting Russian‑speaking users. Defenders should continue to block the domain at network perimeters, monitor for any resurrection of the host, and add the associated IP address to threat intelligence feeds. Further investigation is needed to capture any archived content or phishing payloads that may have been served before takedown.