kra47at[.]lido-ufa[.]ru

This domain, kra47at.lido-ufa.ru, is flagged as an elevated-risk brand impersonation phishing site designed to deceive users by mimicking the legitimate Lido platform. Analysis indicates the domain was specifically crafted to exploit trust in the Lido brand, likely for fraudulent financial transactions or credential harvesting. The page title, 'kra47 - AT мир развлечений для всей семьи,' suggests an attempt to disguise malicious intent under the guise of family entertainment, a common tactic to evade suspicion. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on January 13, 2025, through REGRU-RU, a registrar frequently associated with malicious activity. It resolves to the IP address 91.236.116.20, which has been linked to other suspicious domains. VirusTotal reports that 4 out of 95 security vendors have flagged this domain as malicious, while Gridinsoft assigns it a trust score of 0/100. Additionally, the domain appears on one security blocklist and was proactively blocked by PhishDestroy. The current status of the domain is offline, though this does not eliminate residual risk. Mitigation steps for this specific threat type include immediate blacklisting of the domain and its associated IP address (91.236.116.20) across all network security controls. Organizations should monitor for any residual DNS queries or attempts to access the domain, particularly from endpoints that may have interacted with it prior to takedown. User education should emphasize the risks of brand impersonation, focusing on verifying domain authenticity and reporting suspicious links. Security teams are advised to review logs for connections to the IP address and investigate any potential compromise linked to this phishing campaign.