kra47at[.]aswork[.]ru

The domain kra47at.aswork.ru was created on March 02, 2025 and is currently taken offline. It resolves to the IPv4 address 193.105.134.30, which is assigned to AS42237 operated by w1n ltd in Sweden. The domain is registered through REGRU-RU and uses the authoritative nameservers ns1.regerey.com and ns2.regerey.com. No SSL certificate is presented, indicating that traffic to the site would have been unencrypted. The page title observed before takedown reads "krab1 - AT-рыбалка с технологичным подходом," suggesting the site presented content related to fishing equipment, though the exact nature of the hosted content has not been publicly verified.

Detection tooling reports that 11 of 95 security vendors flagged the domain, and it appears on a single security blocklist. Google Safe Browsing classifies the domain as a social engineering threat, and the anti‑phishing service PhishDestroy has also blocked it. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The overall risk rating assigned is high.

While the domain is presently offline, its infrastructure – including the IP address and hosting provider – remains observable. Defenders should continue to block the domain and its associated IP address at perimeter defenses, monitor for any re‑registration attempts, and include the nameservers in threat‑intelligence feeds. Additional scrutiny of traffic to AS42237 may reveal related malicious activity. The limited detection footprint (single blocklist entry and modest vendor flag count) indicates that the campaign may have been short‑lived or narrowly targeted, but the high risk rating and social engineering flag warrant continued vigilance.