kra47-at[.]schoolpi[.]ru

The domain kra47-at.schoolpi.ru was registered on January 09, 2025 through the REGRU-RU registrar and is served by the ns1.armadns.com and ns2.armadns.com name servers. DNS resolution maps the name to IP address 91.236.116.20, which belongs to AS42237 w1n ltd and is geolocated in Sweden. The site presents a Russian‑language page title reading "kra47 - круглосуточный сервис для CC обслуживания ворот," indicating a claim of offering a 24‑hour gate‑maintenance service, but no legitimate brand is referenced. No SSL certificate is deployed, leaving the HTTP connection unencrypted.

Reputation checks show a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has listed the host as malicious, and VirusTotal analysis recorded five detections out of ninety‑five scanners, confirming that at least a subset of security products consider the domain malicious. The current operational status is offline, suggesting the phishing campaign may have been taken down or is temporarily inactive.

Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor the associated IP range for any reactivation. Incident response teams should also flag any email or credential submissions that reference the claimed gate‑service offering, as threat actors may reuse the same infrastructure for future campaigns. Ongoing observation of the registrar and hosting provider is recommended to detect any new domains that reuse the same name‑server configuration or IP space.