admin[.]kra-----40----cc[.]ru

On July 23, 2026 the domain admin.kra-----40----cc.ru was observed as offline but retains a set of indicators that justify elevated risk classification. The site previously served a page titled "kra45 - эталон профессионализма AT в рекламном проектировании" and was flagged by twelve of ninety‑five VirusTotal scanners, demonstrating partial consensus among malware detection engines. Infrastructure analysis shows the domain is registered through the UK‑WIN registrar and resolves to the IP address 193.105.134.30, which belongs to ASN 42237 hosted in Sweden. The same IP and ASN have been linked to other malicious operations in past threat feeds, reinforcing the suspicion surrounding this host.

Trust‑rating services corroborate the malicious posture: Scamadviser assigns a score of 1 out of 100, while Gridinsoft reports a zero‑score rating, both indicating extreme lack of credibility. The domain appears on one public security blocklist and is actively blocked by the PhishDestroy filtering service. No TLS certificate was observed for the host, meaning any communication would occur over unencrypted HTTP, further exposing potential victims to credential capture.

Because the site is currently offline, real‑time content analysis is not possible, leaving the exact phishing payload unknown. Defenders should continue to block the domain and its associated IP at perimeter firewalls, DNS resolvers, and proxy layers. Monitoring for resurgence of the host or reuse of the IP address in new campaigns is advised, as is adding the domain to internal threat‑intel feeds to accelerate detection of any future re‑activation.