www--kra-47-cc[.]ru[.]www-kra44-cc[.]ru

Analysis of the domain www--kra-47-cc.ru.www-kra44-cc.ru indicates a high‑risk generic phishing operation. The site returned HTTP 200 and presented the page title "Kra47cc твой курс на успех," suggesting a Russian‑language landing page. No additional content has been examined, so the precise phishing vector remains unconfirmed, but the classification aligns with the observed social‑engineering flag from Google Safe Browsing.

Infrastructure profiling shows the domain was registered on November 03 2025 via the registrar DOMENUS‑RU and is hosted on IP 198.251.89.30, which belongs to AS53667 (FranTech Solutions) located in the United States. The domain uses a Let's Encrypt R13 certificate, confirming TLS termination but offering no authentication beyond standard ACME issuance. Authoritative name servers are ns23.asurahosting.com and ns24.asurahosting.com, both typical of low‑cost hosting providers.

Threat intelligence feeds reinforce the malicious assessment. The domain appears on one active security blocklist and is listed by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of reputation. VirusTotal reports that 11 of 95 scanned security vendors flagged the domain, while Google Safe Browsing categorizes it under "SOCIAL_ENGINEERING." These independent signals converge on a consistent high‑risk profile, and the domain remains active as of the report date.

Defenders should proactively block the domain at perimeter and DNS layers, monitor outbound connections to the associated IP address, and incorporate the listed indicators—certificate authority, nameservers, and registration details—into detection rules. Continuous re‑evaluation is advised, as the phishing content may evolve, but current evidence supports immediate remediation to mitigate credential‑harvesting or other social‑engineering threats.