kra47cc[.]ramoboi[.]ru

Analysis of the domain kra47cc.ramoboi.ru indicates it was operating as a high-risk phishing site impersonating a legitimate construction materials supplier. The page title, 'kra47 - производство AT строительных растворов и смесей,' suggests the domain targeted Russian-speaking users by posing as a manufacturer of building solutions. Infrastructure checks reveal the domain was registered on January 7, 2025, through REGRU-RU and resolved to the IP address 193.105.134.30, hosted under AS42237 (w1n ltd) in Sweden. No SSL certificate was present, a common red flag for fraudulent sites.

The domain was flagged by 11 of 95 security vendors on VirusTotal, with Google Safe Browsing specifically classifying it under social engineering. It appeared on one security blocklist and was assigned a trust score of 0/100 by Gridinsoft. Nameservers were ns1.regerey.com and ns2.regerey.com, which have been associated with other malicious domains. The domain was taken offline following detection, but its infrastructure remains a potential indicator of compromise.

Defenders should monitor for related domains using the same nameservers or hosting provider, particularly those targeting construction, manufacturing, or industrial supply chains. While the exact phishing mechanism is not confirmed, the combination of impersonation, lack of encryption, and detection by multiple security vendors strongly suggests malicious intent. No evidence links this domain to a specific phishing kit or brand beyond the page title, and further forensic analysis would be required to determine the full scope of its operation.