kra46-cc[.]annaperenna[.]ru

The domain kra46-cc.annaperenna.ru was registered on 11 December 2024 through the REGRU-RU registrar. The authoritative name servers are ns1.armadns.icu and ns2.armadns.icu, and the domain resolves to the IPv4 address 193.105.134.30, which is announced by AS42237 operated by w1n ltd and geolocated to Sweden. No TLS certificate is presented for the host, indicating that the site was served over plain HTTP. The page title retrieved from the site, "kra46 - цифровая библиотека исторических документов CC," suggests a purported digital library of historical documents, but the content of the page has not been publicly disclosed. Security‑infrastructure analysis shows that the domain is listed on a single security blocklist and has been blocked by the PhishDestroy service.

Google Safe Browsing classifies the URL as a social‑engineering threat. On VirusTotal, ten of ninety‑five scanned security vendors flagged the domain as malicious, confirming a moderate level of detection across independent scanners. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the assessment of high risk. As of the reporting date, the site is reported as taken offline, and no active SSL/TLS configuration is observed.

The limited number of blocklist entries and the relatively low VirusTotal detection count leave some uncertainty regarding the current operational status of the infrastructure, but the combination of registrar information, hosting details, and multiple vendor detections indicates a deliberate phishing deployment. Defenders should add the domain and its associated IP address to local deny lists, monitor for any resurgence of the host, and consider broader threat‑intel correlation with other domains using the same name‑server pair or ASN. Continuous re‑scanning of the IP block is advised, as the offline status may be temporary.