kra46cc[.]boost-365[.]ru

Analysis of kra46cc.boost-365.ru indicates that the domain was created on 1 December 2024 through the Russian registrar REGRU‑RU. The site’s title, “kra46 – комплексный AT рост бизнеса каждый день,” suggests a Russian‑language business‑growth theme but provides no direct evidence of the targeted brand or service. The domain resolves to 193.105.134.30, an address located in Sweden and announced as part of autonomous system AS42237 operated by w1n ltd. Nameservers ns1.regerey.com and ns2.regerey.com are associated with the same registrar and have been observed in other malicious infrastructure.

No TLS certificate is presented, meaning the site was served over plain HTTP, a common characteristic of low‑effort phishing deployments. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole. VirusTotal scans flagged the host by seven of ninety‑five engines, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The current HTTP status is offline, indicating that the site has been taken down or is otherwise inaccessible at the time of analysis.

Because the page content has not been captured, the exact phishing vector, credential‑stealing form, or lure remains unknown. Defenders should continue to block the domain and its resolving IP at perimeter and DNS filters, monitor the associated nameservers for further registrations, and consider adding the IP to threat‑intel feeds. Ongoing observation of the AS42237 block is advised, as the infrastructure could be reused for future campaigns. Until the site is reactivated, investigators should treat any traffic to the domain as hostile and log related events for correlation with potential credential‑theft incidents.