kra46at[.]zesnab75[.]ru

Analysis of kra46at.zesnab75.ru indicates that the domain was actively used for a generic phishing campaign before being taken offline. The site presented the page title "kra46 - AT-сервис промышленного снабжения," suggesting an attempt to impersonate a Russian industrial supply service. Registration data shows the domain was created on December 10, 2024 through the REGRU-RU registrar, and DNS resolution points to the IP address 193.105.134.30 hosted in Sweden under ASN 42237 (w1n ltd). The authoritative name servers are ns1.armadns.com and ns2.armadns.com.

No SSL certificate was observed, leaving the site unencrypted and vulnerable to interception. Reputation metrics are uniformly negative: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal scans recorded 11 detections out of 95 vendors, confirming that multiple security products flagged the host as malicious. The site was also blocked by the PhishDestroy feed, indicating that it was recognized by dedicated anti‑phishing tooling.

Current status is offline, but the infrastructure components—particularly the IP address and name server pair—remain observable and could be reused for future campaigns. Defenders should ensure that the domain and its resolving IP are added to network blocklists, monitor for any re‑registration attempts, and watch for traffic to the associated name servers. Continuous telemetry from DNS and host‑based sensors is recommended to detect any resurgence of the same hosting pattern. While the exact phishing payload and target audience are not publicly documented, the available evidence confirms the domain’s role in a phishing operation and warrants proactive mitigation.