kra46-at[.]hbr-bankrot-netdolgov[.]ru

Analysis of kra46-at.hbr-bankrot-netdolgov.ru indicates a banking phishing domain targeting Russian-speaking users with debt relief or financial services fraud. The domain was registered on December 11, 2024, through REGRU-RU, a registrar frequently associated with malicious infrastructure. As of July 24, 2026, the domain is offline, though historical data reveals it resolved to 193.105.134.30, an IP address hosted on AS42237 (w1n ltd) in Sweden, a network previously linked to phishing and scam operations. The domain lacks an SSL certificate, a common red flag for fraudulent sites, and uses nameservers ns1.armadns.icu and ns2.armadns.icu, which are part of a DNS provider known for hosting high-risk domains.

The page title, 'kra46 - AT решение для списания долгов' (translated: 'kra46 - AT solution for debt write-off'), suggests the site masqueraded as a financial or legal service offering debt relief, a tactic used to lure victims into submitting sensitive banking or personal information. Detection data from July 2026 shows the domain was flagged by 12 of 95 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification.

While the exact content and functionality of the site remain unanalyzed, the combination of technical indicators—absence of SSL, suspicious nameservers, low detection thresholds, and a page title tied to financial fraud—strongly supports its classification as a banking phishing threat. Defenders should treat this domain as compromised and block it at the DNS or network level. Monitoring for re-registration or re-emergence under similar naming conventions (e.g., 'hbr-bankrot', 'netdolgov') is recommended, particularly within AS42237 or other high-risk hosting providers.