kra46at[.]magya-privorotov24[.]ru

This domain, kra46at.magya-privorotov24.ru, operates as a fraudulent Russian-language occult portal designed to deceive visitors seeking magical services. Analysis indicates the site presents itself as a legitimate platform for "приворотов и обрядов" (love spells and rituals), a common social engineering tactic targeting individuals in emotionally vulnerable states. The infrastructure is engineered to harvest personal information, payment details, or deploy malicious payloads under the guise of spiritual consultations or ritual services. The domain’s content and structure align with generic phishing campaigns, where psychological manipulation is used to bypass user skepticism. Evidence confirms the domain’s malicious nature through multiple technical indicators. The domain is flagged by 7 out of 95 security vendors on VirusTotal, with detections spanning phishing and fraud categories. It was registered on December 7, 2024, through REGRU-RU, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 193.105.134.30 and appears on at least one security blocklist. Additionally, the domain has been assigned a trust score of 0/100 by Gridinsoft, further corroborating its malicious classification. The page title, "kra46 - магический портал AT приворотов и обрядов," is consistent with other fraudulent sites impersonating esoteric service providers. Users who visited kra46at.magya-privorotov24.ru should take immediate remedial actions to mitigate potential compromise. First, disconnect the device from the internet to prevent further data exfiltration or command-and-control communication. Conduct a full system scan using updated security tools to detect and remove any installed malware or backdoors. If any credentials, payment details, or personal information were entered on the site, reset passwords for all associated accounts and monitor financial statements for unauthorized transactions. Users should also report the domain to their local cybersecurity authorities or incident response teams to aid in broader threat mitigation efforts. Given the domain’s current offline status, continued vigilance is advised, as threat actors may reactivate or replicate the infrastructure under a different name.