kra46at[.]repsneaker[.]ru

Analysis of kra46at.repsneaker.ru indicates that the domain was created on 10 December 2024 and is currently taken offline. The host resolves to 193.105.134.30, an address assigned to ASN 42237 operated by w1n ltd and geolocated in Sweden. Registration was performed through the Russian registrar REGRU‑RU, and the authoritative name servers are ns1.armadns.icu and ns2.armadns.icu. No TLS certificate is presented, meaning any web traffic would be unencrypted HTTP. Historic page metadata shows the title “kra46 - AT реплики кроссовок премиум‑класса для стильного образа”, implying a focus on premium‑class sneaker replicas, but the page content itself has not been captured for analysis.

Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the host, and three of ninety‑five VirusTotal scanners flagged the domain as malicious. The elevated risk rating aligns with these indicators, while the offline status suggests the operators have either ceased activity or are rotating infrastructure. Because the site lacks a valid certificate, browsers would present security warnings that could be exploited to lure users into ignoring safety prompts.

The absence of HTTPS also precludes the use of HSTS or certificate‑pinning defenses. Defenders should continue to block the domain at DNS and proxy layers, monitor the hosting IP for any re‑use, and update intrusion‑detection signatures to include the observed page title and the specific name‑server pair. Threat intelligence feeds should be updated to reflect the domain’s association with the AS42237 network, and any future resolutions of the IP address to new domains should be flagged for immediate review. Network teams can prioritize this indicator in phishing detection rules without allocating extensive investigative resources.