kra47-cc[.]jugsool[.]ru

Analysis of kra47-cc.jugsool.ru, observed as offline as of July 23 2026, shows a recent registration (created August 19 2025) through the REGRU‑RU registrar. The domain resolves to 193.105.134.22, an address announced by AS42237 (w1n ltd) and geolocated in Sweden. Nameserver records point to ns1.cloudflanre.com and ns2.cloudflanre.com, indicating the use of a third‑party DNS service. No TLS certificate is presented, meaning the site was served over HTTP only.

The page title returned by the server is “kra47 - воплощает муниципалитет СС уровня”, which does not reveal a targeted brand and suggests a generic municipal‑level phishing lure. Reputation metrics are uniformly negative: Gridinsoft assigns a trust score of 0 / 100, Google Safe Browsing flags the URL as social engineering, and the domain appears on one external blocklist while being actively blocked by PhishDestroy. VirusTotal reports 15 detections out of 95 scanned engines, confirming that multiple security products consider the site malicious. The cumulative evidence justifies a high‑risk rating.

Uncertainties remain regarding the specific credential‑stealing mechanisms and any payload delivered, as no content or malware analysis is available. Defenders should add 193.105.134.22 and the associated hostnames to URL filtering and DNS sinkhole rules, enforce HTTPS‑only policies to block fallback to HTTP, and monitor for any re‑registration of the domain or its variants. Continuous re‑scanning of the IP address and the cloudflanre nameservers is recommended, as the infrastructure could be repurposed for further campaigns. Incident response teams may also consider notifying the REGRU‑RU registrar of the abuse to expedite takedown if the domain resurfaces.