kra46-cc[.]posilka-infotv[.]ru

Analysis of the domain kra46-cc.posilka-infotv.ru indicates a high-risk phishing operation targeting credit card information, as evidenced by technical infrastructure and detection metrics. The domain was registered on December 10, 2024, through REGRU-RU, a registrar frequently associated with abusive registrations. As of July 24, 2026, the domain resolves to the IP address 193.105.134.30, hosted on AS42237 (w1n ltd) in Sweden, an autonomous system previously linked to malicious activity. The domain's nameservers, ns1.armadns.icu and ns2.armadns.icu, further suggest the use of bulletproof or low-reputation DNS infrastructure. Google Safe Browsing has classified this domain under 'social engineering,' a designation consistent with phishing campaigns.

The page title, 'kra46 - персонализированная CC рассылка для телевидения,' explicitly references credit card ('CC') distribution, reinforcing the likelihood of a credential harvesting scheme. No SSL certificate was detected, increasing the risk of unencrypted data transmission. Detection metrics from security vendors confirm malicious classification, with 12 of 95 engines on VirusTotal flagging the domain. Additionally, the domain appears on at least one security blocklist and is blocked by PhishDestroy, a specialized anti-phishing service. The domain is currently offline, though this status may change.

Defenders should treat any future resolution of this domain as malicious and prioritize blocking at the DNS or network level. The absence of an SSL certificate, combined with the use of low-reputation hosting and DNS providers, aligns with patterns observed in large-scale phishing campaigns. While the exact target brand or organization remains unconfirmed due to limited page content analysis, the infrastructure and detection data provide sufficient evidence to classify this as a credit card phishing threat. Monitoring for re-activation or related domains under the same registrar or hosting provider is recommended.