kra47cc-------b[.]ru

Analysis of the domain kra47cc-------b.ru was performed on July 25, 2026. The domain resolves to the IPv4 address 91.236.116.20, which belongs to the autonomous system AS42237 operated by w1n ltd and is geolocated in Sweden. Registration was completed on 5 December 2025 through the Russian registrar REGRU-RU. No TLS certificate is present, indicating the site is served over plain HTTP only. The authoritative name servers are ns1.armadns.com and ns2.armadns.com. The page title returned by the host is the raw domain string “kra47cc-------b.ru”.

Threat intelligence flags the site as a generic phishing operation. VirusTotal reports that 12 of 95 scanned security vendors have identified the domain as malicious, confirming the phishing classification. The domain is listed on a single public security blocklist and has been actively blocked by the PhishDestroy network. Gridinsoft’s trust scoring system assigns a zero‑point rating (0/100), reflecting an extremely low reputation. The site’s current HTTP status is offline, indicating that the payload has been taken down or the host is no longer serving content.

Evidence is limited to infrastructure attributes; no content analysis, Safe Browsing verdict, or OTX pulse is available. Consequently, the exact lure or credential‑harvesting method remains uncertain. Defenders should continue to block the domain at network perimeters, update URL filtering lists with the observed IP address and name‑server information, and monitor the AS42237 space for any re‑use of the same hosting resources. Additional probing of the IP should be logged in case the server becomes active again, and any future observations should be correlated with the existing blocklist entries. The combination of multiple vendor detections, zero‑trust score, and blocklist presence classifies the domain as elevated risk for credential theft.