kra47att[.]cc

Analysis of kra47att.cc indicates the domain was registered on 19 November 2025 through NiceNIC International Group Co., Limited and is served from the IP address 185.92.182.44, which belongs to AS56971 Cloud in the United States. The host resolves to three dnspod.com name servers (a.dnspod.com, b.dnspod.com, c.dnspod.com) and runs an Ubuntu operating system behind an Nginx web server. A valid Let's Encrypt certificate (R12) is present, confirming that TLS was correctly configured at the time of observation. The site returns an HTTP 404 status and is currently marked offline by the monitoring team, which aligns with its listing on a security blocklist and the fact that PhishDestroy has actively blocked the domain.

VirusTotal scans show that eight of ninety‑five antivirus engines flagged the domain, reinforcing the suspicion of malicious intent. The only visible page element is the title “KRA - всегда свежие продукты в нашем маркете”, suggesting the site attempted to pose as a grocery‑market offering fresh products, but no further page content has been captured. Because the site is not serving content, the exact phishing vector, credential‑capture mechanisms, or target audience remain unknown.

Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP address for any future activation, and add the domain to internal threat‑intel feeds. Additional investigation, such as retrieving archived snapshots or probing the server for hidden endpoints, may reveal the intended payload. Until further evidence is obtained, the domain should be treated as a high‑confidence phishing indicator.