kra------40cc[.]ru

Analysis of kra------40cc.ru shows a domain that was actively hosting a generic phishing page titled "kra45 - онлайн-школа CC программирования с индивидуальным подходом" before being taken offline. Twelve of ninety‑five VirusTotal scanners flagged the domain, indicating a moderate level of detection across multiple security vendors. The site received a Gridinsoft trust score of zero out of one hundred, reinforcing the conclusion that it is untrusted. No TLS certificate was observed, meaning communications were unencrypted and vulnerable to interception.

Registration was performed through the UK‑WIN registrar, associated with ASN 42237, and the domain resolves to the IP address 193.105.134.30, which is allocated to a Swedish hosting provider (AS42237 w1n ltd). The IP address appears on a single security blocklist and the domain itself has been blocked by the PhishDestroy mitigation service. Current status is offline, preventing immediate interaction, but the historical evidence suggests the infrastructure was deliberately used for phishing.

Defenders should continue to block the domain at perimeter defenses, monitor DNS queries for the associated IP, and add the IP to internal blocklists. Because the site is no longer reachable, any ongoing campaigns would need to shift to new infrastructure; however, the registrar and hosting details provide a potential attribution vector for threat‑hunting activities. Continuous observation of UK‑WIN registrations and the AS42237 network is advised to detect similar future deployments.