kra46at[.]padayatra[.]ru

Analysis of kra46at.padayatra.ru shows a domain created on 11 December 2024 and presently taken offline. The site was indexed by PhishDestroy and appears on one additional security blocklist. VirusTotal reports three of ninety‑five scanners flagging the domain, indicating partial detection by security vendors. The page title observed during the brief capture was “kra46 – воплощает муниципалитет СС уровня”, which does not reveal a targeted brand but confirms the presence of a Cyrillic‑language landing page.

No TLS certificate is presented, so connections are unencrypted. Gridinsoft assigns a trust score of 0 out of 100, reflecting a highly untrusted reputation. Registration was performed through the Russian registrar REGRU‑RU, and the authoritative nameservers are ns1.armadns.icu and ns2.armadns.icu. DNS resolution points to IP 193.105.134.30, hosted in Sweden under ASN 42237 (w1n ltd).

The limited visibility—single blocklist entry and a modest detection count—leaves the full scope of the phishing campaign uncertain, including the specific victim population and any credential‑harvesting mechanisms. Defenders should block the domain at perimeter firewalls and proxy solutions, add the IP address to threat‑intel feeds, and monitor for any related sub‑domains under the same nameserver pair. Continuous re‑scanning with VirusTotal and other sandbox services is advised to capture any evolving payloads. Organizations that handle Cyrillic‑language communications should be especially vigilant for emails or URLs referencing this domain, even though the site is currently offline.