kra46-cc[.]esh-kashu[.]ru

The domain kra46-cc.esh-kashu.ru was registered through REGRU-RU on 2024-12-01. It resolves to the IPv4 address 193.105.134.30, which belongs to AS42237 w1n ltd and is geolocated to Sweden. The authoritative name servers are ns1.regerey.com and ns2.regerey.com. No TLS certificate was observed, indicating that the site operated without HTTPS. The page title returned by the HTTP response is “kra46 - уникальная CC концепция для любителей шашлыков”, which does not reference a known brand and suggests a generic content scheme.

VirusTotal scans recorded six positive detections out of ninety‑five AV engines, and the domain is listed on a single external blocklist. PhishDestroy has already taken the site offline, and the current status is reported as offline. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high likelihood of malicious use. The combination of a recent registration, a single‑purpose hosting IP, multiple vendor detections, and the absence of TLS strongly suggests that the domain was used for a phishing campaign targeting Russian‑speaking users.

However, the exact phishing template, credential‑harvesting endpoint, and targeted victim profile have not been publicly disclosed, leaving the full scope of the operation uncertain. Defenders should add kra46-cc.esh-kashu.ru and its resolved IP 193.105.134.30 to network and DNS blocklists, monitor for any residual traffic to the address, and inspect logs for related query patterns. Because the site is already offline, threat‑hunt activities should focus on possible reuse of the infrastructure, especially the hosting provider and name server pair, which may host additional malicious domains. Continuous re‑evaluation of the domain’s status in threat‑intel feeds is recommended.