kra46-at[.]zesnab75[.]ru

The domain kra46-at.zesnab75.ru was registered on December 10, 2024 through the Russian registrar REGRU-RU. It resolves to the IPv4 address 193.105.134.30, which is allocated to AS42237 w1n ltd in Sweden. The authoritative nameservers are ns1.armadns.com and ns2.armadns.com. No SSL certificate is presented for the host, and the site is currently taken offline.

Threat intelligence indicates that the domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. VirusTotal analysis shows that 11 of 95 scanned security vendors flagged the domain, reinforcing the suspicion of abuse. The page title retrieved during the brief observation was "kra46 - AT поставки оборудования для строительства," which translates to a reference to equipment supply for construction, suggesting the site may have been used to lure victims with a fabricated commercial offering.

Concrete evidence of the phishing payload, credential collection, or malware delivery has not been publicly disclosed, leaving the exact attack vector uncertain. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP address for any resurgence, and consider adding the host to internal blocklists. Ongoing surveillance of the registrar REGRU-RU and the hosting provider w1n ltd is advised, as similar domains have been observed leveraging the same infrastructure.