kra46c-cc[.]ru

This domain is classified as a high-risk phishing infrastructure specializing in brand impersonation, specifically targeting Google users. The site mimics legitimate Google services to deceive victims into entering credentials or downloading malicious content, a tactic commonly associated with credential harvesting and account takeover schemes. The use of a non-standard domain name (kra46c-cc.ru) and a misleading page title in Russian ('Kra46 — туманные пейзажи, мягкий свет и природная дымка CC версия') suggests an attempt to evade detection while appealing to a specific linguistic demographic or exploiting thematic lures to lower user vigilance.

Analysis of the domain reveals multiple technical indicators of malicious activity. The domain kra46c-cc.ru was registered on November 22, 2025, through REGRU-RU, a registrar frequently associated with abusive domains. It resolves to the IP address 193.105.134.21, located in Sweden (SE) under AS42237 (w1n ltd), an autonomous system with a history of hosting phishing and malware distribution sites. The domain appears on one security blocklist and is flagged by Google Safe Browsing as phishing. VirusTotal reports 17 out of 95 security vendors detecting the domain as malicious, with no SSL certificate present, further reducing its legitimacy. The page title, while seemingly innocuous, aligns with techniques used to disguise phishing pages as benign content until user interaction occurs.

Mitigation against this type of brand impersonation phishing requires a multi-layered approach. Organizations should implement domain-based message authentication (DMARC), sender policy framework (SPF), and DomainKeys Identified Mail (DKIM) to prevent email spoofing. End-users should be trained to scrutinize domain names, particularly those using homoglyphs, subdomains, or unusual top-level domains (TLDs) to mimic trusted brands. Network-level protections, such as blocking known malicious IPs (e.g., 193.105.134.21) and domains (e.g., kra46c-cc.ru) at the firewall or DNS resolver, are critical. Additionally, browser-based protections, including Safe Browsing APIs and real-time URL scanning, should be enforced to prevent access to confirmed phishing sites. Given the domain's current offline status, continuous monitoring for re-registration or migration to new infrastructure is recommended.