kra47-------at[.]ru

This domain, kra47-------at.ru, is flagged as a generic phishing threat targeting users under the guise of a creative development platform. The page title, 'kra47 - AT пространство для развития креативных идей,' suggests an attempt to lure individuals interested in creative or collaborative projects, though no specific brand impersonation or crypto drainer kit signatures have been confirmed. The site appears designed to harvest credentials or distribute malicious payloads through social engineering tactics. Analysis indicates the domain was registered on November 27, 2025, through RU-CENTER-RU, a registrar frequently associated with high-risk domains. It resolves to the IP address 193.105.134.22, hosted on AS42237 (w1n ltd) in Sweden, an autonomous system with a history of hosting malicious infrastructure. VirusTotal reports 11 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The domain lacks an SSL certificate, further reducing its legitimacy and increasing exposure to interception attacks. No detections were recorded in Google Safe Browsing at the time of analysis. The domain is currently offline, likely due to takedown actions or infrastructure changes. However, the elevated risk persists due to the domain's recent creation, association with a high-risk registrar, and prior malicious activity. Organizations and individuals are advised to block the domain and its resolving IP at the network level. Monitoring for re-registration or migration to new infrastructure is recommended, as threat actors often re-deploy phishing assets under altered domains or IPs. Users should verify the legitimacy of any platform claiming to offer creative or collaborative services before engaging.