kra46cc[.]ledi-cb[.]ru

Analysis of kra46cc.ledi-cb.ru indicates that the domain is currently offline but exhibits multiple indicators of a high‑risk generic phishing operation. The domain was registered on 11 December 2024 through the Russian registrar REGRU‑RU and is served by the authoritative nameservers ns1.armadns.icu and ns2.armadns.icu. DNS resolution points to the IPv4 address 193.105.134.30, which belongs to AS42237 (w1n ltd) located in Sweden. No TLS certificate is presented, confirming the lack of encrypted transport.

The page title retrieved before takedown reads “kra46 – AT сообщество для женщин, вдохновлённых модой”, suggesting an attempt to lure Russian‑speaking female users with fashion‑related content. Google Safe Browsing flags the domain for social engineering, and the site appears on one external security blocklist. Independent scanning on VirusTotal returned 14 positive detections out of 95 submitted engines, and the domain is explicitly blocked by the PhishDestroy service. Local reputation scoring from Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious classification.

The combination of a recent registration, low‑cost DNS hosting, a single‑IP hosting footprint, lack of SSL, and multiple vendor detections provides a high confidence that the domain was used for credential‑ harvesting or similar phishing tactics. Because the site is already taken offline, immediate remediation focuses on updating local blocklists, ensuring that any cached DNS entries are purged, and monitoring the hosting provider’s IP range for potential re‑use. Defenders should also review inbound traffic logs for connections to 193.105.134.30 during the active period and consider notifying the registrar REGRU‑RU to enforce takedown if further abuse is observed.