kra47at[.]sadmechta[.]ru

This domain, kra47at.sadmechta.ru, operates as a credit card phishing platform designed to harvest banking credentials under the guise of "secure asset management technology." The page title, "kra47 - CC технологии для безопасного управления банковскими активами," explicitly references credit card systems, indicating a targeted effort to deceive users into submitting sensitive financial data. The absence of an SSL certificate further exposes visitors to unencrypted data interception, increasing the risk of credential theft during transmission. Analysis of the domain infrastructure reveals multiple high-risk indicators. The domain was registered on January 13, 2025, through REGRU-RU, a registrar frequently associated with malicious activity. VirusTotal detection shows 11 out of 95 security vendors flagging the domain as malicious, while it appears on one additional security blocklist. The domain resolves to IP address 91.236.116.20, hosted on AS42237 (w1n ltd) in Sweden, an autonomous system with a history of hosting phishing and malware distribution sites. These technical markers confirm the domain’s role in a coordinated phishing campaign. Users who visited kra47at.sadmechta.ru should immediately revoke any entered credentials, particularly banking or credit card details. Monitor financial accounts for unauthorized transactions and enable multi-factor authentication on all critical services. If browser sessions were active during the visit, clear cached data and run a full antivirus scan to detect potential malware. Report the incident to relevant financial institutions and consider placing a fraud alert on credit files. Network administrators should block the domain and its associated IP (91.236.116.20) at the perimeter to prevent further exposure.