kra47-at[.]express-poezdka[.]ru

The domain kra47-at.express-poezdka.ru is a generic phishing site designed to deceive users into disclosing sensitive information. It does not impersonate a specific brand or employ a known crypto drainer kit. As of the latest verification, the site has been taken offline, reducing immediate risk but leaving past victims potentially exposed.

Technical indicators confirm kra47-at.express-poezdka.ru was flagged by 1 of 95 VirusTotal security vendors, including SOCRadar, and appeared on 1 security blocklist (PhishDestroy). The domain was created on 2026-02-21 07:01:08 and resolved to the IP address 193.105.134.30, hosted in Sweden under AS42237 (w1n ltd). Its SSL certificate was issued by R12, and the observed page title was 'krab1 - AT мастерская по обработке натурального камня'. Google Safe Browsing did not flag the domain at the time of analysis.

Users who interacted with kra47-at.express-poezdka.ru should assume their credentials may have been compromised. Change passwords for all accounts accessed from the device used to visit the site, prioritize accounts with financial or personal data, and enable two-factor authentication where available. Monitor accounts for unauthorized activity and report the phishing domain to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities to aid in broader mitigation efforts.