kra--43-----at[.]ru

Analysis as of July 24 2026 indicates that the domain kra--43-----at.ru resolves to the IPv4 address 91.236.116.20, which is allocated to AS42237 (w1n ltd) in Sweden. The domain was registered on October 28 2025 through the RU‑CENTER‑RU registrar. No SSL/TLS certificate is presented, and the site is presently taken offline. The page title retrieved before takedown reads “kra46 - предельно результативный изготовление манжет резинотехнических с полезными AT возможностями”, which does not reference a legitimate brand and is consistent with a generic phishing lure. Six of ninety‑five antivirus and URL‑reputation engines on VirusTotal flagged the domain, indicating a moderate level of detection consensus.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single external blocklist, specifically PhishDestroy, which has already blocked it. Authoritative name servers ns1.armadns.com and ns2.armadns.com resolve the domain, confirming that the DNS infrastructure is under the control of the attacker rather than a compromised third‑party service. The lack of an SSL certificate further reduces user confidence and may be used to encourage insecure HTTP connections. Because the site is currently offline, dynamic analysis of the landing page cannot be performed, and the exact phishing vector (e.g., credential‑stealing form or malicious download) remains uncertain. However, the presence of the Russian‑language title describing “manufacturing of rubber‑technical cuffs with useful AT capabilities” aligns with typical obfuscation tactics used to attract curiosity.

The domain’s exclusive appearance on PhishDestroy and its low reputation score indicate that it has not yet been widely propagated, but the detection by six independent security vendors suggests that malicious activity has already been observed. Defenders should add 91.236.116.