kra46[.]shanghai-rnd[.]ru
“kra46.shanghai-rnd.ru”
kra46.shanghai-rnd.ru — Conteúdo indisponível. Resumo das evidências: VirusTotal 3/95 (Google Safebrowsing, Lionic, SOCRadar); Google Safe Browsing flagged; PhishDestroy score 80/100. Registrador: REGRU-RU.
A análise detalhada do PhishDestroy AI permanece em inglês para preservar o registro forense original.
On 24 July 2026 the domain kra46.shanghai-rnd.ru was observed as offline but continues to be referenced in multiple security data sources. The domain was registered on 10 December 2024 through the Russian registrar REGRU-RU and is delegated to the authoritative name servers ns1.armadns.icu and ns2.armadns.icu. DNS resolution points to the IPv4 address 193.105.134.30, which belongs to autonomous system AS42237 operated by w1n ltd and is geolocated to Sweden. No TLS certificate is presented for the host, indicating that any HTTP service would be delivered over clear-text connections only.
Google Safe Browsing classifies the site as a social-engineering threat, and the Gridinsoft trust scoring system assigns a rating of 0 out of 100, reflecting a high confidence in malicious intent. VirusTotal reports that three of ninety-five scanned security vendors flagged the domain, and it appears on a single external blocklist. The PhishDestroy service has also listed the domain as blocked. The page title returned from the server, when it was reachable, is the literal string "kra46.shanghai-rnd.ru", providing no additional context about the content or targeted brand.
Because the site is currently offline, direct content analysis is not possible, and the lack of an SSL certificate precludes verification of any credential-harvesting forms that may have been hosted. Nevertheless, the convergence of multiple independent detections—Google Safe Browsing, Gridinsoft, VirusTotal, and PhishDestroy—combined with the low trust score and the registration pattern, suggests the domain was employed for a phishing campaign. Defensive teams should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the IP address 193.105.134.30, and incorporate the observed indicators of compromise into threat-intel feeds. Ongoing observation of the registrar REGRU-RU and the associated name servers may reveal future infrastructure reuse.
Pipeline de resposta a ameaças
Status da lista de bloqueios pública
Captura armazenada
Inteligência de Domínios
Detalhes técnicosDNS, SANs do SSL, carimbos de data e hora
Análise do VirusTotal
Evidências e relatórios externos
Você foi afetado por este site?
Se você inseriu credenciais de conta, informações pessoais ou de pagamento, ou baixou um arquivo deste domínio, tome medidas imediatas. Abaixo estão os recursos para ajudá-lo a relatar o incidente e se proteger.
Notifique as autoridades locais
Selecione seu país para obter contactos oficiais do cibercrime ou crie um rascunho de reclamação →.
Verificar qualquer domínio
Análise de ameaças usando lista de bloqueio armazenada, WHOIS, DNS e evidências de verificação pública
Digitalize agoraDenunciar phishing
Envie domínios suspeitos para nosso banco de dados de ameaças — proteja a comunidade
DenunciarFeed de ameaças em tempo real
Relatórios recentes de phishing e alterações de disponibilidade observadas
MonitorarMantenha-se informado, mantenha-se seguro
Monitore ameaças em tempo real ou conteste esta listagem caso acredite que se trate de um falso positivo