kra47at[.]taxi-alina[.]ru

This domain, kra47at.taxi-alina.ru, is flagged as a credential phishing site targeting users of Russian driving schools. The page title "krab1 - AT автошкола нового поколения" suggests an attempt to impersonate legitimate auto school platforms, likely aiming to harvest login credentials or payment details from students. No specific drainer kit signatures were identified, but the generic_phishing classification indicates broad targeting of personal and financial data through deceptive forms or fake login portals.

Infrastructure analysis reveals the domain was registered on February 21, 2026, with an SSL certificate issued under the R12 root. It resolves to the IP address 193.105.134.30, hosted on AS42237 (w1n ltd) in Sweden. VirusTotal detection metrics show 13 out of 95 security vendors flagging the domain as malicious, while it appears on one additional security blocklist. The domain is not currently listed in Google Safe Browsing (GSB) at the time of analysis, though it has been proactively blocked by at least one threat intelligence feed.

As of the latest assessment, kra47at.taxi-alina.ru has been taken offline, reducing immediate exposure risk. However, the infrastructure (IP, registrar, and hosting provider) may still pose residual threats if repurposed for future campaigns. Organizations should monitor for related indicators, including the IP 193.105.134.30 and SSL certificate R12, and implement DNS-based blocking for the domain if historical access logs indicate prior compromise. End-users should be advised to verify the authenticity of auto school websites through official channels and avoid entering credentials on untrusted platforms.