kra46[.]shanghai-rnd[.]ru

On 24 July 2026 the domain kra46.shanghai-rnd.ru was observed as offline but continues to be referenced in multiple security data sources. The domain was registered on 10 December 2024 through the Russian registrar REGRU-RU and is delegated to the authoritative name servers ns1.armadns.icu and ns2.armadns.icu. DNS resolution points to the IPv4 address 193.105.134.30, which belongs to autonomous system AS42237 operated by w1n ltd and is geolocated to Sweden. No TLS certificate is presented for the host, indicating that any HTTP service would be delivered over clear-text connections only.

Google Safe Browsing classifies the site as a social-engineering threat, and the Gridinsoft trust scoring system assigns a rating of 0 out of 100, reflecting a high confidence in malicious intent. VirusTotal reports that three of ninety-five scanned security vendors flagged the domain, and it appears on a single external blocklist. The PhishDestroy service has also listed the domain as blocked. The page title returned from the server, when it was reachable, is the literal string "kra46.shanghai-rnd.ru", providing no additional context about the content or targeted brand.

Because the site is currently offline, direct content analysis is not possible, and the lack of an SSL certificate precludes verification of any credential-harvesting forms that may have been hosted. Nevertheless, the convergence of multiple independent detections—Google Safe Browsing, Gridinsoft, VirusTotal, and PhishDestroy—combined with the low trust score and the registration pattern, suggests the domain was employed for a phishing campaign. Defensive teams should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the IP address 193.105.134.30, and incorporate the observed indicators of compromise into threat-intel feeds. Ongoing observation of the registrar REGRU-RU and the associated name servers may reveal future infrastructure reuse.