kra47-cc-com[.]ru

On July 24 2026, the domain kra47-cc-com.ru was assessed as an elevated‑risk phishing infrastructure. The domain was registered through the Russian registrar REGRU‑RU on 8 December 2025 and resolves to the IP address 91.99.132.101, which belongs to Hetzner Online GmbH (ASN 24940) in Germany. The hosting provider is a known bulk‑hosting service, and the lack of an SSL certificate means the site is reachable only over plain HTTP. The page title returned from the live endpoint before takedown reads “kra47 cc — сервис, где визитки делают впечатление | Печать и подбор форматов”, indicating a focus on business card printing services, but no further content analysis is available because the site is currently offline.

Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 out of 100, the domain appears on one security blocklist, and PhishDestroy has actively blocked it. AlienVault OTX lists the domain in three separate threat‑intel pulses, and VirusTotal reports that 14 of 93 scanning engines flagged the domain as malicious. The nameservers are sureena.ns.cloudflare.com and woz.ns.cloudflare.com, which are typical Cloudflare delegations and do not provide mitigation by themselves. The combination of a recent registration date, association with a high‑reputation hosting provider, absence of TLS, and multiple independent detections suggests that the domain was used to host a phishing campaign targeting users interested in printing services.

Because the site is already taken offline, immediate mitigation focuses on preventing future resolution. Defenders should add the domain and its IP address to firewall deny lists, update DNS‑sinkhole configurations, and monitor for any re‑registration attempts that reuse the same nameserver pattern or hosting ASN. Continuous observation of the associated IP block for new malicious activity is also recommended, as Hetzner infrastructure is frequently recycled for short‑lived abuse campaigns.