kra44-cc-vpn[.]ru

Analysis as of July 25, 2026 shows that kra44-cc-vpn.ru is presently taken offline but retains multiple technical markers of malicious intent. The domain resolves to the IPv4 address 193.105.134.21, which is assigned to the Swedish network AS42237 operated by w1n ltd. No TLS certificate is presented, meaning the site would serve content over plain HTTP only if reachable. Reputation data from Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of confidence in the host.

The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal analysis reports that 14 of 95 scanned security vendors flagged the domain, reinforcing the assessment of risk. Registration details reveal the domain was created on 16 November 2025 through the REGRU-RU registrar, using the standard Russian nameservers ns1.reg.ru and ns2.reg.ru. The only visible page title is "Kra44 — мастерская электро-инструментов и ремонта CC версия," which suggests a Russian‑language workshop theme but provides no evidence of the content served.

Because the site is offline, the exact nature of the phishing payload—whether credential harvesting, malware delivery, or other deception—is unknown. Defenders should continue to deny traffic to the IP 193.105.134.21, add the domain to internal blocklists, and monitor for any re‑registration or resurrection of the host. Ongoing vigilance is recommended, especially given the active detection by multiple vendors and the low trust score, to prevent potential future exploitation.