kra46at[.]podkluchit-domashniy-internet[.]ru

Analysis of the domain kra46at.podkluchit-domashniy-internet.ru indicates it was a phishing site targeting users of home internet services, specifically masquerading as an assistance tool for AT connections, as evidenced by the page title 'kra46 - AT помощник подключения домашнего интернета'. The domain was registered on December 11, 2024, through REGRU-RU and has since been taken offline, though it remains flagged on at least one security blocklist, PhishDestroy. Infrastructure analysis reveals the domain resolved to the IP address 193.105.134.30, hosted under AS42237 (w1n ltd) in Sweden, a network previously associated with malicious activity. The domain used nameservers ns1.armadns.icu and ns2.armadns.icu, which are linked to other suspicious domains and may indicate a broader phishing infrastructure.

Thirteen of ninety-five security vendors on VirusTotal flagged this domain, suggesting a moderate level of detection consensus, though the absence of an SSL certificate further undermines its legitimacy. The Gridinsoft trust score of 0/100 corroborates the elevated risk assessment. While the exact content and mechanics of the phishing scheme are not fully analysed, the page title implies an attempt to deceive users into entering credentials or personal information under the guise of home internet setup assistance. Defenders should treat this domain as compromised and ensure it is blocked at the network level.

Monitoring for related domains using the same nameservers (armadns.icu) or hosting provider (AS42237) may help identify additional threats. Given the domain's offline status, further forensic analysis may be limited, but historical DNS and WHOIS records should be reviewed for indicators of compromise. No evidence links this domain to a specific phishing kit or targeted brand beyond the 'AT' reference in the page title, which may refer to a local or regional internet service provider.