kra46cc[.]kinregal[.]ru

Analysis of kra46cc.kinregal.ru, which was taken offline prior to the assessment, shows a set of infrastructure indicators that align with a generic phishing operation. The domain was registered on December 07, 2024 through the REGRU-RU registrar and resolves to the IPv4 address 193.105.134.30, which is announced by AS42237 (w1n ltd) and geolocated to the Czech Republic. DNS resolution is handled by ns1.regerey.com and ns2.regerey.com. No TLS certificate is present, meaning the site was served over plain HTTP only.

The page title retrieved before takedown reads "kra46 - премиальный CC кинотеатр с уникальными залами," suggesting a Russian‑language promotional theme but providing no further insight into the payload. VirusTotal reports that nine of ninety‑five scanning engines flagged the domain, indicating a modest but notable detection rate among security vendors. The domain appears on a single public blocklist, PhishDestroy, and receives a Gridinsoft trust score of 0 out of 100, reinforcing the malicious classification.

While the offline status prevents direct verification of the landing page content, the combination of a recent registration, lack of encryption, low trust score, and multiple vendor detections constitutes strong evidence of phishing intent. Defenders should continue to block the domain at network perimeter devices, update DNS filtering policies to include the listed nameservers, and monitor the associated IP range (AS42237) for any resurgence of malicious activity. Incident response teams encountering related email or credential‑harvesting attempts should correlate timestamps with the domain creation date and consider the possibility of credential theft targeting Russian‑language services.