kra46at[.]filtr-partner[.]ru

Analysis indicates that the domain kra46at.filtr-partner.ru was registered on 7 January 2025 through the REGRU-RU registrar. It resolves to the IPv4 address 193.105.134.30, which belongs to AS42237 (w1n ltd) and is geolocated in Sweden. The authoritative name servers are ns1.regerey.com and ns2.regerey.com. No TLS certificate is present, and the site currently returns no HTTP response because it has been taken offline. The page title retrieved during the brief live window was identical to the domain name, providing no additional context about the intended victim or lure.

Multiple defensive feeds have flagged the domain. Google Safe Browsing categorises it as a social engineering threat. The domain is listed on one public blocklist and has been added to the PhishDestroy blacklist. VirusTotal reports that 12 out of 95 scanned security vendors flagged the domain as malicious, demonstrating a moderate consensus of compromise. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious use.

The evidence points to a generic phishing operation, but the specific target brand or campaign details are not disclosed in the available data. Because the site is presently offline, real‑time content analysis is not possible, leaving the exact phishing payload or credential‑harvesting technique uncertain. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole lists, and monitor for any resurgence of the domain or related sub‑domains. Additional scrutiny of traffic to the hosting ASN (AS42237) and the registrar (REGRU-RU) may reveal further malicious infrastructure. Organizations using threat‑intelligence platforms should ingest the provided indicators—domain name, IP address, name‑servers, registration date, and associated blocklist entries—to improve detection and prevent credential compromise.