kra46-cc[.]torgradio[.]ru

This domain, kra46-cc.torgradio.ru, is engineered to harvest user credentials through deceptive login interfaces mimicking legitimate services. Analysis indicates the site employs social engineering tactics to trick visitors into submitting sensitive information, such as usernames, passwords, and potentially multi-factor authentication codes, under false pretenses. The infrastructure is designed to blend with authentic platforms, increasing the likelihood of successful compromise for unsuspecting users. Evidence supporting this assessment includes detection by 9 out of 95 security vendors on VirusTotal, with classifications explicitly identifying the domain as a credential theft operation. The domain was registered on December 10, 2024, through REGRU-RU, a registrar frequently associated with malicious activity. It appears on one security blocklist and is flagged by Google Safe Browsing as phishing. The SSL certificate, issued via Hestia Control Panel and linked to a VPS provider (nova-amd-nl-3-v-3-6291185-55314-zomro.vps.ac), resolves to the IP address 193.105.134.30, hosted on AS42237 (w1n ltd) in Sweden. Users who visited kra46-cc.torgradio.ru should assume their credentials may have been compromised. Immediate steps include resetting passwords for any accounts accessed or entered on the site, enabling multi-factor authentication where available, and monitoring associated accounts for unauthorized activity. System scans using updated security tools are recommended to detect potential secondary infections. Network administrators should block the domain and its resolving IP (193.105.134.30) at the perimeter to prevent further exposure. If financial or personally identifiable information was submitted, affected individuals should follow local incident reporting procedures for identity protection.