kra47--cc[.]ru

Analysis of the domain kra47--cc.ru indicates active phishing infrastructure with high-risk characteristics. Registered on March 28, 2026, through RU-CENTER-RU, the domain currently resolves to IP address 172.67.134.120, which is protected by Cloudflare. The SSL certificate is issued by Google Trust Services, a common pattern observed in both legitimate and malicious domains leveraging Cloudflare's services. At the time of this report, the domain returns a 404 Not Found page title, suggesting either a placeholder state, a takedown of specific malicious content, or a cloaking mechanism to evade detection. Defenders should note that this domain appears on two security blocklists and has been flagged in 22 threat intelligence pulses within AlienVault OTX, indicating prior malicious activity or association with known threat actors. Detection engines PhishDestroy and BLP-Malware have blocked this domain, while two out of 95 security vendors on VirusTotal have flagged it as malicious. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. The exact nature of the phishing campaign remains unclear due to the absence of visible content; however, the domain's infrastructure and detection history warrant immediate blocking at the network perimeter. Security teams are advised to monitor any future resolutions or changes in page content, as the domain may transition from a dormant state to active phishing operations. Given the use of Cloudflare, defenders should also consider implementing policies to inspect encrypted traffic where feasible, as malicious payloads may be delivered over HTTPS. No specific brand or scam type has been confirmed at this stage, and further analysis of active content would be required to determine the precise threat vector.