kra46at[.]oradecor-rus[.]ru

Analysis of the domain kra46at.oradecor-rus.ru shows that it was registered on 11 December 2024 through the REGRU-RU registrar. The authoritative name servers ns1.armadns.icu and ns2.armadns.icu resolve the domain to the IPv4 address 193.105.134.30, which belongs to AS42237 operated by w1n ltd and is geolocated in Sweden. No TLS certificate is presented, indicating that the site serves content only over HTTP. The sole page title observed, “kra46 - AT декорирование интерьеров премиум-класса”, suggests a Russian‑language interior‑decorating service, but no further content has been captured because the host is currently taken offline. Threat‑intelligence feeds flag the domain as malicious.

VirusTotal records ten of ninety‑five scanning engines marking the host as suspicious, and the domain appears on one public blocklist. PhishDestroy has explicitly blocked the address, and the Gridinsoft trust score is 0 out of 100, the lowest possible rating. These indicators collectively point to a generic phishing campaign, consistent with the reported threat type. Uncertainty remains regarding the exact phishing payload, the targeted brand or credential‑collection mechanism, and whether the site ever delivered malicious content before being taken offline. No SSL certificate, absence of public malware samples, and lack of additional sandbox observations limit the depth of the current assessment.

Defenders should add the domain and its associated IP address to deny‑list rules in perimeter firewalls, DNS filtering, and endpoint protection solutions. Monitoring for future resolution to the same IP or reuse of the ns1/ ns2.armadns.icu name servers is advised. Because the domain is already offline, immediate containment is straightforward, but analysts should retain the indicator set for correlation with any related phishing attempts that may surface later.