ftp[.]kra-----40cc[.]ru

The domain ftp.kra-----40cc.ru is currently listed as offline and has been taken down by the PhishDestroy sinkhole. Technical analysis shows that the hostname resolves to the IPv4 address 193.105.134.30, which belongs to an autonomous system (AS42237) operated by w1n ltd and is geolocated to Sweden. The registration was performed through the UK‑WIN registrar, which is associated with the same ASN (42237). No TLS certificate is presented for the site, indicating that the service was delivered over plain HTTP only.

The single observed page title, 'kra45 - эталон профессионализма AT в рекламном проектировании', does not reveal a targeted brand or a clear lure, but the classification in the supplied intelligence is 'generic phishing'. VirusTotal reports that 12 of 95 scanning engines flagged the domain as malicious, confirming a consensus of malicious intent among a minority of vendors. The domain appears on one external blocklist and received a Scamadviser trust score of 1 out of 100 and a Gridinsoft score of 0 out of 100, both indicating extremely low credibility.

Because the site is already offline, immediate remediation focuses on preventing future resolution to the same infrastructure. Defenders should add 193.105.134.30 to network deny lists, enforce DNS‑based blocking of ftp.kra-----40cc.ru, and monitor the hosting ASN for new registrations that reuse the same registrar or IP range. Continuous observation of threat‑intel feeds for any resurgence of the domain or related indicators is recommended, as the current evidence does not disclose the exact phishing payload or victim profile.