kra47cc--------d[.]ru

Analysis of the domain kra47cc--------d.ru indicates it was actively involved in a credential harvesting phishing campaign prior to being taken offline. The domain resolved to the IP address 91.236.116.20, hosted under AS42237 (w1n ltd) in Sweden. Registration occurred on December 5, 2025, through the registrar REGRU-RU, a provider frequently associated with malicious domains. Nameservers were configured as ns1.armadns.com and ns2.armadns.com, infrastructure previously observed in other phishing operations.

Detection data from July 25, 2026, shows the domain was flagged by 11 of 95 security vendors on VirusTotal, though the specific detection rules and signatures remain unconfirmed. The domain appears on at least one security blocklist, and Gridinsoft assigned a trust score of 0/100, reinforcing its classification as malicious. No SSL certificate was present, increasing the likelihood of interception or manipulation of unencrypted traffic. The page title, matching the domain name (kra47cc--------d.ru), provides no clear indication of a targeted brand or service, suggesting a generic or opportunistic phishing attempt rather than a campaign mimicking a specific organization.

Defenders should treat this domain as compromised infrastructure. Historical DNS and IP associations should be reviewed for related activity, particularly within AS42237 and domains registered via REGRU-RU. Network-level blocks at 91.236.116.20 and monitoring of the armadns.com nameserver cluster are recommended to mitigate potential resurgence or lateral movement to new domains. Given the domain's offline status, further forensic analysis may be limited, but retrospective log reviews for connections to the IP or domain should be prioritized to identify affected systems or users.