krak46-c-c[.]ru

Analysis of krak46-c-c.ru shows multiple indicators of compromise consistent with a generic phishing operation. The domain was registered on February 21, 2026 and resolves to the IPv4 address 193.105.134.21, which belongs to the Swedish autonomous system AS42237 operated by w1n ltd. The hosting location in Sweden does not align with the Russian‑language page title "Kra46 cc — универсальный магазин автозапчастей," suggesting a possible attempt to masquerade as a local automotive parts retailer. The SSL certificate associated with the site carries an R13 rating, which is considered low confidence and may indicate a self‑signed or otherwise untrusted certificate.

Gridinsoft, a known reputation engine, assigns the domain a trust score of 0 out of 100, reflecting a complete lack of trustworthiness. On VirusTotal, three out of ninety‑three scanning engines flagged the domain, providing independent corroboration of malicious behavior. The domain appears on a single external blocklist and has been specifically blocked by the PhishDestroy service, reinforcing its identification as a phishing resource. Current monitoring indicates the site has been taken offline, but historical observations remain relevant for threat‑intel correlation.

Defenders should continue to block any resolution of krak46-c-c.ru at the network level, monitor for related DNS queries, and consider the IP 193.105.134.21 as a potentially malicious host. Given the limited public evidence, the exact phishing payload or target audience remains uncertain; however, the convergence of low trust scores, malicious SSL rating, and multiple vendor detections warrants an elevated risk posture. Organizations are advised to update intrusion‑prevention signatures, incorporate the domain and its IP address into denylists, and remain vigilant for future re‑hosting attempts that may reuse the same infrastructure.