kra47cc------------------a[.]ru

Analysis of kra47cc------------------a.ru shows a newly registered domain (creation date December 5 2025) that was actively used for a generic phishing operation before being taken offline. The domain resolves to the IPv4 address 91.236.116.20, which is hosted in Sweden and belongs to AS42237 w1n ltd. Nameserver resolution points to ns1.armadns.com and ns2.armadns.com, indicating use of the Armadns DNS service. No TLS certificate is presented, meaning the site was served over HTTP only, a common characteristic of low‑cost phishing infrastructure.

Reputation services flag the domain as malicious: 11 of 95 VirusTotal scanners have reported it, Gridinsoft assigns a trust score of 0 / 100, and the domain appears on at least one external blocklist. PhishDestroy has already blocked the domain, confirming its phishing nature. Registration was performed through the Russian registrar REGRU‑RU, which often hosts disposable or short‑lived abusive domains. The page title returned by the web server matches the domain name exactly, offering no additional context about the targeted brand or payload.

Because the site is currently offline, direct content analysis is unavailable, leaving the specific phishing template and credential‑ harvesting method uncertain. Defenders should continue to block the IP address 91.236.116.20, add the domain to URL filtering and DNS sinkhole lists, and monitor for re‑registration or related domains using the same nameserver pair or ASN. Ongoing vigilance is advised, especially for users of services that may have been impersonated, even though the exact target brand is not disclosed in the available data.