kra47at[.]mdsnn[.]ru

Analysis of kra47at.mdsnn.ru shows a high‑risk generic phishing infrastructure that is currently offline. The domain was registered on 4 March 2025 through the Russian registrar REGRU‑RU and uses the nameservers ns1.regerey.com and ns2.regerey.com. Its sole observed IP address is 193.105.134.30, which belongs to AS42237 operated by w1n ltd and is geolocated in Sweden. No TLS certificate is presented, indicating that the site served content only over HTTP.

The page title returned during the brief online window was “krab1 – AT система анализа бизнес‑тенденций”, suggesting a spoofed business‑trend analysis service, but the content has not been captured for further verification. Security‑vendor scans on VirusTotal recorded 12 positive detections out of 95 scanners, and Google Safe Browsing flags the domain for social‑engineering. Gridinsoft assigned a trust score of 0 / 100, and the site appears on a single public blocklist. PhishDestroy has also listed the domain as blocked.

The combination of multiple vendor detections, a zero trust score, and explicit safe‑browsing classification supports a definitive phishing categorisation. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP address for any re‑activation, and add the domain to internal blacklist feeds. Because the site is offline, active payload analysis is not possible; however, the observed infrastructure—particularly the Swedish‑based IP and the Russian registrar—may be reused for future campaigns. Ongoing observation of the nameservers and the IP range is recommended to detect potential re‑hosting of malicious content.