kra46-at[.]mknrm[.]ru

Analysis of the domain kra46-at.mknrm.ru indicates a high-risk phishing operation targeting business automation services. The domain, created on December 10, 2024, and registered through REGRU-RU, was flagged by 14 of 95 security vendors on VirusTotal before being taken offline. It appears on at least one security blocklist, specifically PhishDestroy, and is categorized by Google Safe Browsing as engaging in social engineering. The page title, 'kra46 - AT автоматизация рабочих процессов для бизнеса,' suggests an attempt to impersonate a legitimate business automation service, though the exact content and target brand remain unconfirmed due to the site's current offline status.

Infrastructure analysis reveals the domain resolved to the IP address 193.105.134.30, hosted on AS42237 (w1n ltd) in Sweden. The nameservers, ns1.armadns.icu and ns2.armadns.icu, are associated with other suspicious domains, further indicating a pattern of malicious infrastructure reuse. Notably, the domain lacks an SSL certificate, a common red flag for phishing sites, as it increases the likelihood of unencrypted data transmission. Gridinsoft assigns a trust score of 0/100, reinforcing the domain's high-risk classification.

While the domain is currently offline, defenders should treat any residual DNS records or cached content as potentially malicious. Organizations are advised to block the domain and its associated IP address (193.105.134.30) at the network level, monitor for attempts to re-register or re-host the domain, and alert users to the social engineering tactics implied by the page title. Given the domain's recent creation and rapid flagging by multiple security vendors, it is likely part of a broader campaign targeting businesses seeking automation tools. Further investigation into the hosting provider and nameserver infrastructure may uncover additional related threats.