cdn[.]kra----36----cc[.]ru

Analysis of cdn.kra----36----cc.ru, registered through REGRU-RU on July 27 2025, shows a high‑risk phishing indicator despite the domain being taken offline at the time of assessment. The domain resolves to IP 193.105.134.30, which is allocated to AS42237 operated by w1n ltd in Sweden. No SSL certificate is presented, leaving the HTTP channel unencrypted and susceptible to interception. Nameserver records point to ns1.regerey.com and ns2.regerey.com, both of which are commonly used by disposable or fast‑flux hosting services, further hinting at malicious intent.

VirusTotal scans have flagged the domain in 15 of 95 security‑vendor engines, a notable detection rate that aligns with other reputation signals. Google Safe Browsing classifies the site as a social‑engineering threat, and PhishDestroy has actively blocked it, confirming its use in phishing campaigns. The domain appears on a single security blocklist and receives a Gridinsoft trust score of 0 out of 100, indicating an absence of trustworthiness. The page title returned by the server is identical to the domain name, offering no legitimate content or branding that could be used for verification.

While the offline status limits immediate exposure, the combination of registrar, hosting, detection vendor consensus, and blocklist presence suggests the domain was deployed for phishing activity, likely targeting credential theft or credential‑reuse attacks. Defenders should continue to block the domain at perimeter filters, monitor any residual DNS queries for the IP address 193.105.134.30, and update threat‑intelligence feeds to include this indicator. Given the lack of SSL and the low trust score, any future re‑activation of the domain should be treated as hostile until a thorough forensic review confirms remediation.