kra46cc[.]bukvoezhka36[.]ru

Analysis of kra46cc.bukvoezhka36.ru shows a high‑risk phishing infrastructure that was taken offline prior to the report date of 23 July 2026. The domain was registered on 10 December 2024 through the REGRU‑RU registrar and resolves to the IPv4 address 193.105.134.30, which belongs to AS42237 w1n ltd and is geolocated in Sweden. No TLS certificate is presented; the site is reachable only over HTTP, which aligns with the absence of SSL information in the intelligence. The page title returned by the server is “kra46 - интерактивная CC платформа для обучения чтению”, indicating a Russian‑language educational platform, but no further content analysis is available.

Reputation metrics are uniformly negative: Gridinsoft assigns a trust score of 0 / 100, Google Safe Browsing flags the domain for social engineering, and the site appears on one security blocklist. VirusTotal reports that 13 of 95 scanning engines have flagged the domain, confirming malicious intent. PhishDestroy has also listed the domain as blocked, reinforcing the classification as a phishing resource. Nameserver records point to ns1.armadns.icu and ns2.armadns.icu, which are commonly associated with fast‑flux or disposable hosting services.

The combination of a recent registration, low‑trust score, multiple vendor detections, and a lack of encryption suggests the domain was used to host credential‑stealing or social‑engineering content before being taken down. Uncertainty remains regarding the exact payload or credential collection mechanisms, as no screenshots or form details have been disclosed. Defenders should immediately add kra46cc.bukvoezhka36.ru and its resolved IP 193.105.134.30 to deny lists, monitor for re‑registration or similar subdomains, and enforce outbound filtering for HTTP traffic to the identified nameservers. Continuous telemetry from DNS, proxy, and endpoint solutions is advised to detect any resurgence of the infrastructure.