kra46-at[.]resto-bel[.]ru

Analysis of kra46-at.resto-bel.ru confirms a high-risk phishing domain masquerading as a Belarusian cuisine delivery service. The domain, registered on December 10, 2024, through REGRU-RU, currently resolves to IP 193.105.134.30, hosted on AS42237 (w1n ltd) in Sweden. No SSL certificate is present, increasing exposure to interception. Nameservers ns1.armadns.icu and ns2.armadns.icu are linked to prior malicious infrastructure, though specific threat actor attribution remains unconfirmed.

The page title, 'kra46 - AT ресторан белорусской кухни с доставкой', suggests a localized phishing campaign targeting Russian-speaking users, though the exact content and payload are not yet analyzed. Detection vendors have flagged the domain: Gridinsoft assigns a trust score of 0/100, PhishDestroy blocks it, and Google Safe Browsing classifies it as social engineering. VirusTotal reports 13 detections from 95 security vendors, indicating broad consensus on malicious intent. The domain appears on one security blocklist, further corroborating its risk profile.

Infrastructure analysis reveals the use of Armadns nameservers, a pattern observed in previous phishing operations, though no specific phishing kit or brand impersonation is confirmed beyond the page title. Defenders should treat this domain as active phishing infrastructure, block resolution at DNS and network levels, and monitor for related domains using the same nameserver or IP range. Given its offline status as of July 24, 2026, the domain may resurface under altered infrastructure; continuous monitoring is advised.