kra46at[.]farmaciait24[.]ru

Analysis conducted on July 24 2026 identifies the domain kra46at.farmaciait24.ru as part of an active phishing infrastructure. The domain was registered on December 11 2024 through the REGRU‑RU registrar and resolves to the IPv4 address 193.105.134.30, which is announced by AS42237 belonging to w1n ltd and geolocated to Sweden. The hosting provider does not present a TLS certificate, indicating that the site was served over plain HTTP at the time of collection. The authoritative name servers are ns1.armadns.icu and ns2.armadns.icu. The page title returned by the live endpoint reads “kra46 – AT платформа для заказа лекарств онлайн”, suggesting a claim of an online pharmacy platform, while the intelligence classification lists the campaign as an investment scam.

Gridinsoft assigned a trust score of 0 out of 100, and the domain is currently listed on a single security blocklist. Independent scanning on VirusTotal recorded 13 positive detections out of 95 scanners, confirming that multiple AV engines flag the domain as malicious. The domain has been taken offline and is reported as “offline” by the monitoring system, but historical evidence shows it was previously blocked by the PhishDestroy sinkhole. Defenders should immediately add 193.105.134.30 and the domain name to deny‑list rules in perimeter firewalls and DNS filtering solutions.

Continuous monitoring of the AS42237 prefix is advised, as the same infrastructure may host additional malicious domains. Because the site lacked TLS, network‑level inspection of clear‑text HTTP traffic could reveal further indicators of compromise. Organizations that have previously received unsolicited communications referencing online pharmacy services or investment opportunities should treat any correspondence referencing this domain as malicious. The lack of a valid certificate and the low trust score reinforce the recommendation to treat the domain as hostile until a formal takedown is confirmed.