kra46at[.]credit-vzyat[.]ru

Analysis indicates that the domain kra46at.credit-vzyat.ru was registered on 5 December 2024 through the Russian registrar REGRU‑RU and is currently taken offline. The authoritative name servers ns1.regerey.com and ns2.regerey.com resolve the domain to the IP address 193.105.134.30, which belongs to the AS42237 network operated by w1n Ltd and is geolocated in Sweden. No TLS certificate is presented, meaning the site would have been served over plain HTTP if active. The page title observed during a brief fetch before takedown reads “kra46 - воплощает муниципалитет СС уровня”, suggesting the site attempted to pose as a municipal entity, although the exact target is not explicitly identified in the available data.

Reputation services flag the domain as malicious. Twelve of ninety‑five VirusTotal scanners reported detections, and the domain appears on a single public blocklist. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of a low‑reputation resource. PhishDestroy has also listed the domain as blocked, indicating that at least one anti‑phishing feed recognized it as a phishing vector.

Given the lack of an SSL certificate, the offline status, and the limited public exposure, the current risk to end users is primarily historical; however, the infrastructure components—namely the Russian‑registered registrar, the European‑based hosting AS, and the reused name‑server pair—are typical of campaigns that recycle domains for short‑lived phishing attacks. Defenders should continue to block the domain at perimeter firewalls and DNS resolvers, monitor for any resurrection of the host or related sub‑domains, and consider adding the IP address 193.105.134.30 to reputation‑based deny lists. Additional scrutiny of any future registrations from the same registrar or name‑server set is advisable, as they may be leveraged for similar fraudulent operations.