kra46-cc[.]newmp3top[.]ru

This domain, kra46-cc.newmp3top.ru, is flagged as a credential harvesting phishing infrastructure targeting users through deceptive media-themed lures. Analysis indicates an elevated risk level due to its recent registration and confirmed malicious activity, including detection by multiple security vendors. The domain presents itself under the guise of a music platform, using the page title 'kra46 - музыкальная вселенная CC качества звука' to appear legitimate and entice victims into entering sensitive credentials or downloading malicious content.

Infrastructure analysis reveals the following technical indicators: the domain was registered on December 05, 2024, through REGRU-RU, a registrar frequently associated with suspicious domains. It resolves to the IP address 193.105.134.30 and is currently offline. VirusTotal reports that 6 out of 95 security vendors have flagged this domain as malicious, while it appears on at least one security blocklist. Additionally, the domain holds a trust score of 0/100, further corroborating its malicious nature. The presence of these indicators suggests a deliberate effort to establish phishing infrastructure with minimal detection evasion.

To mitigate risks associated with this credential harvesting phishing domain, organizations and users should implement the following measures: immediately block the domain kra46-cc.newmp3top.ru and its resolving IP address 193.105.134.30 at the network perimeter. Deploy endpoint protection rules to prevent access to the domain and monitor for any attempts to contact it. Educate users about the tactics employed by phishing campaigns, particularly those leveraging fake media platforms or high-quality content lures. For incident responders, analyze logs for connections to the domain or IP address to identify potential compromised systems. Additionally, consider implementing domain reputation checks in security workflows to proactively block newly registered domains with similar characteristics.