kra46-at[.]bezfonov[.]ru

Analysis of the domain kra46-at.bezfonov.ru indicates that it is part of a confirmed phishing infrastructure. The site was created on December 10, 2024 and is hosted at IP address 193.105.134.30, which belongs to the Swedish autonomous system AS42237 owned by w1n ltd. The domain resolves to this IP and is served without an SSL certificate, exposing all traffic to potential interception. Registrant information shows the domain was registered through the Russian registrar REGRU-RU, and the authoritative nameservers are ns1.armadns.com and ns2.armadns.com.

Reputation data from Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal scans report that eight of ninety‑five security vendors flagged the domain, reinforcing the malicious assessment. The page title returned by the server is "kra46 - AT защита от телефонного спама," suggesting a focus on telephone‑spam protection but providing no evidence of legitimate service. The site has been taken offline and is listed as blocked by the PhishDestroy sinkhole.

While the exact phishing kit or targeted brand is not disclosed in the available data, the combination of low trust score, multiple vendor detections, blocklist presence, and lack of HTTPS indicates a high likelihood of credential‑stealing or fraud activity. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the resolved IP, and add the domain to internal blocklists. Incident response teams should also check for any recent authentication attempts from internal users to the IP address and consider credential rotation if exposure is suspected. Ongoing intelligence collection is recommended to identify any related infrastructure that may share the same registrar, nameserver set, or hosting ASN.