kra-43-cc-at[.]ru

This domain is flagged as a high-risk phishing threat specifically targeting users of Kra43 CC, a payment portal service. Analysis indicates the site employs generic phishing tactics to harvest credentials or financial data, likely through a fake login or transaction interface. The page title, 'Kra43 CC — твой вкус AT,' suggests an attempt to mimic legitimate Kra43 CC branding while using localized language to increase credibility. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and currently resolves to the IP address 193.105.134.74, hosted on AS42237 (w1n ltd) in Sweden. VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing and one additional security blocklist have also marked it as phishing. The domain lacks an SSL certificate, further reducing its legitimacy. Registration details and hosting provider data align with patterns observed in short-lived phishing campaigns. Mitigation steps for this threat include immediate blocking of the domain and its associated IP (193.105.134.74) at the network perimeter. Organizations should deploy web filtering rules to prevent access to kra-43-cc-at.ru and monitor for any attempts to reach it from internal systems. End-users should be alerted to verify payment portals directly through official Kra43 CC channels, avoiding links from emails or third-party sites. Security teams are advised to check logs for connections to 193.105.134.74 or the domain within the past 48 hours, as this aligns with typical phishing campaign lifecycles.